restful-authentication | 易学教程

Integrating Token based security into existing Spring Security web application

阅读更多关于 Integrating Token based security into existing Spring Security web application

问题 I am designing a RESTful web services that needs to be accessed by user after proper authentication. I have already developed Security for my application using Spring Security 3.0. Now I want to integrate TokenBasedAuthentication. But I stuck here for how do i do this. My ApplicationContextSecurity.xml: <global-method-security pre-post-annotations="enabled"> </global-method-security> <beans:bean id="myAccessDecisionManager" class="com.app.security.MyAccessDecisionManager"> </beans:bean> <http

Setting Up Postman for API Testing When Using Passport Authorization

阅读更多关于 Setting Up Postman for API Testing When Using Passport Authorization

问题 I am a bit confused while trying to get Postman to work when testing the API of my application. Namely, I am using Passport authentication; however, I do not know which type it defaults to or uses in my code. How can I figure this out and which type should I choose in Postman? Here is the relevant Passport code: var login = require('./login'); var signup = require('./signup'); var User = require('../models/user'); module.exports = function(passport, path, nodemailer, sesTransport,

SAML 2.0 based Authentication for iPhone application

阅读更多关于 SAML 2.0 based Authentication for iPhone application

问题 Team, kindly help me how to implement SAML based authentication for iPhone application. I have .NET REST based JSON webservice as my backend service. Kindly advice me on this requirement. 回答1: There are existing standards and tools to support your requirement today. As Scott mentioned, it does require either using the embedded browser in iOS within your application or allowing the iOS Safari Browser to handle the SAML/Browser portion of SSO (each has its own pros/cons). You can check out this

Integrating Token based security into existing Spring Security web application

阅读更多关于 Integrating Token based security into existing Spring Security web application

I am designing a RESTful web services that needs to be accessed by user after proper authentication. I have already developed Security for my application using Spring Security 3.0. Now I want to integrate TokenBasedAuthentication. But I stuck here for how do i do this. My ApplicationContextSecurity.xml: <global-method-security pre-post-annotations="enabled"> </global-method-security> <beans:bean id="myAccessDecisionManager" class="com.app.security.MyAccessDecisionManager"> </beans:bean> <http auto-config="true" once-per-request="true" access-decision-manager-ref="myAccessDecisionManager"

Infinite loop in custom Spring Security application

阅读更多关于 Infinite loop in custom Spring Security application

We try to substitute an existing Spring Security Basic Login for a REST-API in an Open Source Application to achieve a custom login with a token. I read this blogpost about the topic: http://javattitude.com/2014/06/07/spring-security-custom-token-based-rest-authentication/ When the request has no header named "Cookie", I get correcty a 401 - unauthorized response (expected behaviour). When the request has a valid token, I get an infinite loop causing a java.lang.StackOverflowError : Exception in thread "http-bio-8080-exec-45" java.lang.StackOverflowError at org.apache.tomcat.util.http

What is the current standard for authenticating Http requests (REST, Xml over Http)?

阅读更多关于 What is the current standard for authenticating Http requests (REST, Xml over Http)?

The standard should solve the following Authentication challenges like- Replay attacks Man in the Middle Plaintext attacks Dictionary attacks Brute force attacks Spoofing by counterfeit servers I have already looked at Amazon Web Services and that is one possibility. More importantly there seems to be two most common approaches: Use apiKey which is encoded in a similar fashion like AWS but is a post parameter to a request Use Http AuthenticationHeader and use a similar signature like AWS. Signature is typically obtained by signing a date stamp with an encrypted shared secret. This signature is

Solutions to web service client certificates/auth best practices

阅读更多关于 Solutions to web service client certificates/auth best practices

问题 I have a simple web service that has an API third party developers are allowed to access. The API mostly follows REST principles. I'm interested in solutions to make the API more secure by requiring developers to use client certificates. Is there any open source solutions or other implementation advice any of you have that would assist in REST based APIs using user level certificates for auth? 回答1: My generic advice would be to keep your API separate from your authentication routines. Your

API Call Authentication in Python ( Working PHP example )

阅读更多关于 API Call Authentication in Python ( Working PHP example )

问题 I'm trying to write a script to communicate with an online exchange. 'Public' requests are sent to : https://yobit.net/api/3/ 'Trade' requests are sent to: https://yobit.net/tapi/ My public requests work great. My 'private calls' however return a 404 error. My keys are 100% correct. I currently produce the following URL: https://yobit.net/tapi/activeorders/ltc_btc/&apikey=MY_APIKEY_HERE&nonce=1456192036 Did I missinterpret the documentation? Perhaps a false URL structure? Documentation Link -

What status code should I use when session token is invalid?

阅读更多关于 What status code should I use when session token is invalid?

问题 When creating a web service (RESTful), what status code should I use when session token is invalid? Currently the one in my company sends me a 404, not found, but I think this is not correct, because the resource exists. Maybe I should use 401 Unauthorized. What do you think? What status code do you recommend me to use in this scenario? Thanks. 回答1: 401 Unauthorized. Your existing session token doesn't authorize you any more, so you are unauthorized. Don't forget that a session token is just

Securing REST endpoint using spring security

阅读更多关于 Securing REST endpoint using spring security

I am trying to provide security to the REST endpoints. I am following instructions from this page . In my case I don't have view hence I haven't created controller to specify the views and haven't added viewResolver in my AppConfig.java After implementation it correctly shows the access denied error upon calling a secured REST endpoint. But even though I specify username/password in the request header I get the access denied error. I am testing in postman setting username/password in Basic Auth. What am I missing any idea? The example you have followed is implementing a form-based