Java EE 6 中基于令牌的身份验证
我想为类似于以下的场景实现基于令牌的身份验证机制：
在 Google 日历中，您可以邀请来宾参加您的活动，而来宾可以直接通过电子邮件邀请来响应这些活动。此类活动的邀请包含相应的链接，用于使用 URL 中编码的身份验证令牌进行响应（是、否、也许）。这些身份验证令牌仅限于特定事件和用户。
生成这些只能执行有限操作并且只能访问有限资源（并且可能仅在有限时间内有效）的“一次性”令牌的最佳实践是什么？我如何在 Glassfish 中实现这一点？我想通过我的应用程序的 RESTful API 公开这一点（使用 Jersey）。目前，我的应用程序中的所有 URL 路径都通过身份验证约束进行保护，该约束是我在 web.xml 中配置的。
我的方法如下：
- 提供一个不应用身份验证约束的 URL（例如 /token_auth），并将其用于令牌身份验证。
- 在 Web 服务方法中，手动检查安全令牌并执行所需的操作。令牌与用户名、到期日期、授权资源等信息一起保存在数据库中。
我想知道是否有更优雅的解决方案使用任何框架或内置容器功能来避免所有手动工作。以及该解决方案是否可能存在一些安全缺陷。
之前也有人问过类似的问题：Newbie at JAASauthentication;使用网址栏中的令牌登录
I want to implement a token-based authentication mechanism for a scenario which is similar to the following:
In Google Calendar, you can invite guests to your event, who in turn can respond to these events right from the email invitation. The invitation to such an event contains the respective links to respond (Yes, No, Maybe) with authentication tokens encoded in the URL. These authentication tokens are restricted to the specific event and user.
What's the best practice to generate these kinds of "one-time" tokens that can only perform limited actions and have only access to limited resources (and potentially are only valid for a limited amount of time)? And how do I implement this in Glassfish? I want to expose this through the RESTful API of my application (using Jersey). Currently, all URL paths in my app are secured with an authentication constraint, which I configured in the web.xml.
My approach to this would be as follows:
- Provide a URL where no authentication constraint is applied (e.g. /token_auth) and use this for token authentication.
- In the web service method, manually check the security tokens and do the required actions. The tokens are saved in the DB along with information such as username, expiration date, authorized resources, etc.
I was wondering whether there is a more elegant solution using any frameworks or built-in container capabilities that can avoid all the manual work. And whether this solution might have some security drawbacks.
A similar question has been asked on SO before: Newbie at JAAS authentication; Sign in using a token in the URL Bar
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您研究过 UUID 吗？
在工作中，我们使用 Safehaus UUID。
Have you looked into UUIDs?
At work we use the Safehaus UUID.
你的方法看起来不错。我不知道有什么框架可以为你做这种事情。 Spring Security 可能有一些你可以使用的东西，但不是全部。
You approach looks fine. I am not aware of a framework to do this kind of thing for you. Spring Security may have something you can use but not the whole thing.