构建从 ajax 前端访问的安全 RESTful Web 服务层的最佳方法API请求
我有一个使用 jboss Resteasy 构建的 jax-rs Web 服务层。所有 Web 服务都会消耗并生成 json 对象。我需要保护这一层来处理来自不同来源的请求。
ws 可以通过 ajax 前端通过基于表单的登录来访问。因此，我需要将用户会话存储在服务器上，并在每个 ws 请求中检查它是否存在。
此外，我想使用某种 HMAC（没有 OAuth）身份验证通过 REST API 公开 Web 服务。
有人知道实现它的解决方案吗？如果有一个可以处理来自两个来源的请求的集中式授权组件，那就太好了。
I have a jax-rs web service layer built with jboss resteasy. All the web services consume and produce json objects. I need to secure this layer to handle requests coming from separate sources.
The ws can be accessed by an ajax front end with form based login. Therefore I need to store the user session on the server and check the existence of it on every ws request.
Moreover, I'd like to expose the web services through a REST API using some sort of HMAC (without OAuth) authentication.
Does anybody know a solution to achieve it? It would be great to have a centralized authorization component that could handle the requests from both sources.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以编写一个基于 JSR-196 的提供程序来为您处理这两个用例，然后为两个端点进行配置。可能需要添加一些鉴别器，以便服务知道如何验证随机请求（例如，可以根据 URL 在提供程序中进行配置）。
You could write a JSR-196 based provider that would handle both use cases for you, then configure that for both end points. May need to add some discriminator so that the service would know how to authenticate a random request (could be configured in the provider based on the URL, for example).
我不确定处理这个问题的 100% 最佳方法，但我遇到了类似的问题。如果您发现它适用，我将分享它。 （我不熟悉resteasy）基本上，我们的移动平台插入了现有的REST Web服务。我被要求将移动服务中的一些数据显示到我们具有表单身份验证的 Web 应用程序。
解决方案是获取 FormsAuthentication cookie 并将其添加到您发送到服务的请求的标头中，并且服务将解密该 cookie 以获取发出请求的用户。
这做出了 2 个假设：1. 您的服务和 Web 应用程序都使用相同的加密密钥，2. 一旦您通过 FormsAuth 登录，您的服务就不必再次完全验证用户凭据。因此，该服务基本上只是说“我可以解密令牌吗？这是一个有效的用户吗？”
I am not sure the 100% best way to handle this, but I had a similar problem. I will share it in case you find that it applies. (I am not familiar with resteasy) Basically there were existing REST web service that our mobile platforms plugged into. I was asked to display some data from the mobile services to our web app that had forms authentication.
The solution was to take the FormsAuthentication cookie and add it to the header of the request that you are sending to the service and the service will decrypt that cookie to get the user that is making the request.
This is making 2 assumptions: 1. That both your service and your web app are using the same encryption keys and 2. that once you log in via FormsAuth your service doesnt have to fully authenticate the users credentials again. So the service is just basically saying "Can I decrypt the token? and is this a valid user?"