Java EE 7 / JAX-RS 2.0: Simple REST API Authentication &

For convenience and further code error reduction,let’s put the HTTP Header names into an interface as static final variables for the use in the rest of the classes.

Codes for DemoHTTPHeaderNames.java:

For the implementation of the authentication process and other demo methods,the methods’ signature are defined in DemoBusinessRESTResourceProxy,along with the appropriate HTTP Methods,parameters and the business implementation is defined in DemoBusinessRESTResource.

Codes for DemoBusinessRESTResourceProxy.java:

Codes for DemoBusinessRESTResource.java:

The?login()?method is to authenticate the username,the password and also the right service key. After?login(),the authorization token will be generated and returned to the client. The client will have to use it for any other methods invocation later on. The?demoGetMethod()?and the?demoPostMethod()?are just dummy methods which returns a JSON message for demo purpose,but with a special condition that a valid authorization token must be present. The?logout()?method is to log the user out of the REST service; user is identified by the “auth_token“.

The service key and the authorization token will be made available to the REST service methods through:

@Context HttpHeaders httpHeaders

The httpHeaders,an instance of?,is an object that contains the header name and values for the use of the application further on. But in order to get the REST service to accept the HTTP Header,something needs to be done first through both the REST request interceptor and the response interceptor.

Authentication With HTTP Headers Through JAX-RS 2.0 Interceptors

Due to certain security limitation,just don’t hope that any HTTP headers could be passed using any REST client and expect the REST service to accept it. It just doesn’t work that way.

In order to make a specific header to be accepted in the REST service,we have to define the acceptance of HTTP Header very specifically in the response filter interceptor.

Codes for DemoRESTResponseFilter.java:

DemoRESTResponseFilter?is a JAX-RS 2.0 interceptor which implements?ContainerResponseFilter. Don’t forget to annotate it with both @Provide and @PreMatching. In order to allow certain specific custom HTTP headers to be accepted,the header name “Access-Control-Allow-Headers” follow by the value of custom headers with “,” as the separator must be added as part of the custom headers value. This is the way to inform the browser or REST client of the custom headers allowed. The rest of the headers are for CORS,which you can read more in one of our articles?

Next,to validate and verify the service key and authorization token,we need to extract it out from the HTTP Headers and pre-process it with the request filter interceptor.

Codes for DemoRESTRequestFilter:

To get the header value,we invoke the getHeaderString() method of the object instance of ContainerRequestContext,for example:

String serviceKey = requestCtx.getHeaderString( "service_key" );

The rest of the codes in?DemoRESTRequestFilter?is pretty straight forward on validating and verifying the service key and the authorization token.

REST Service Deployment

Don’t forget to have the web.xml for the enablement of REST service define.

Codes for web.xml:

For this demo,I have packaged the compiled codes into a war file naming it?RESTSecurityWithHTTPHeaderDemo.war. I have chosen to deploy on Glassfish 4.0 on the domain developerscrappad.com (the domain of this blog). If you are going through everything in this tutorial,you may choose a different domain of your own. The REST API URLs will be in the format of:

http://:/RESTSecurityWithHTTPHeaderDemo/rest-api/path/method-path/

. Anyway,the summary of the URLs for the test client which I’m using are:

<table>

Access-Control-Allow-Headers: custom_header_name1,custom_header_name2