restful-authentication | 易学教程

angular 2 login with spring security

阅读更多关于 angular 2 login with spring security

im trying to integrate spring security with a custom angular 2 login, that is a specific endpoint of my app is protected with spring security, trying to access it will redirect to /login that is handled in angular 2. as things stands now i have no clue as to how to perform the login and grant access to the backend API once logged. i am configuring spring security as follows: @Override protected void configure(final HttpSecurity http) throws Exception { http .csrf().disable() .cors().and() .authorizeRequests() .antMatchers("/api/someEndpoint/**") .hasRole(ADMIN_ROLE).and().formLogin()

Licenses and sessions the RESTful way

阅读更多关于 Licenses and sessions the RESTful way

问题 This question crossed my mind after I read this post: “Common REST Mistakes: Sessions are irrelevant” If sessions are indeed discouraged in a RESTful application. How would you handle licenses in such application. I'm specifically referring to concurrent licenses model and not named licenses. i.e. the customer buys X licenses which means the application may allow up to X users to be logged in simultaneously. Which means that the application must hold a state for current logged in users. I

Resource level authorization in RESTful service

阅读更多关于 Resource level authorization in RESTful service

问题 Let /users/{id} be a resource url in RESTful service. Basic authentication is enabled and only authenticated users are allowed to access the url. Example Scenario: User_1 & User_2 are authenticated users with userId 1 & 2. Since both are authenticated, both of them are having access to, /users/1 /users/2 But the expectation is User_1 should have access to /users/1 and not to /users/2 or other userId. Question: How to do resource level authorization in RESTful services? Note: I am implementing

Restful web service authentication

阅读更多关于 Restful web service authentication

问题 I have a Restful web service API, that is being used by different 3rd parties. Part of that API is restricted (you need username/password to access it). I was wondering what would be the best way of implementing authentication? I'm using https, so communication is encrypted. I have two ideas: Before user starts using (restricted) service, it sends username/password using POST (since https is being used credentials are encrypted). After the login is successful, server sends back random single

How to use jti claim in a JWT

阅读更多关于 How to use jti claim in a JWT

问题 The JWT spec mentions a jti claim which allegedly can be used as a nonce to prevent replay attacks: The jti (JWT ID) claim provides a unique identifier for the JWT. The identifier value MUST be assigned in a manner that ensures that there is a negligible probability that the same value will be accidentally assigned to a different data object; if the application uses multiple issuers, collisions MUST be prevented among values produced by different issuers as well. The jti claim can be used to

Spring Security Token Authentication - RESTful JSON Service

阅读更多关于 Spring Security Token Authentication - RESTful JSON Service

问题 I'm looking to use Spring Security for a Spring MVC application which will strictly be a JSON web service. I've done some research and read a few articles but haven't really found anything complete. I want the application to be completely stateless and use token based authentication. I don't want the Spring MVC application to have any forms, or used forms to authenticate. It should strictly take requests and data in JSON, and return JSON responses. There will be an Angular JS client

What is an efficient way to create/manage RESTful API with grails?

阅读更多关于 What is an efficient way to create/manage RESTful API with grails?

I've built my first grails application. My URL mappings are what the default application provides: static mappings = { "/$controller/$action?/$id?"{ constraints { // apply constraints here } } "/"(view:"/index") "500"(view:'/error') } Senario I have a controller called ColorController with actions save and list . It simply does something like this: def save () { def colorInstance = new Color(params) colorInstance.save(flush: true) } def list () { [colorList: Color.list, colorTotal: Color.count()] } I would like to build a simple API for these actions. The save action should accept parameters

Solutions to web service client certificates/auth best practices

阅读更多关于 Solutions to web service client certificates/auth best practices

I have a simple web service that has an API third party developers are allowed to access. The API mostly follows REST principles. I'm interested in solutions to make the API more secure by requiring developers to use client certificates. Is there any open source solutions or other implementation advice any of you have that would assist in REST based APIs using user level certificates for auth? My generic advice would be to keep your API separate from your authentication routines. Your web server should handle the interaction for you. Solutions for your side of the client-certificate scenario

API Call Authentication in Python ( Working PHP example )

阅读更多关于 API Call Authentication in Python ( Working PHP example )

I'm trying to write a script to communicate with an online exchange. 'Public' requests are sent to : https://yobit.net/api/3/ 'Trade' requests are sent to: https://yobit.net/tapi/ My public requests work great. My 'private calls' however return a 404 error. My keys are 100% correct. I currently produce the following URL: https://yobit.net/tapi/activeorders/ltc_btc/&apikey=MY_APIKEY_HERE&nonce=1456192036 Did I missinterpret the documentation? Perhaps a false URL structure? Documentation Link ---> here Each Trade API request should pass authentication. Authentication is fulfilled by sending the

How to uniquely identify your Android app for rest API

阅读更多关于 How to uniquely identify your Android app for rest API

Is there a way to uniquely identify my Android App in Java code? Maybe some combination of the package name and something else? I know there is a way to identify a unique Android device , but that is not what I am looking for. I want to be able to uniquely identify my Android app that I made so that I can then pass that information to my own private RESTful API. This would allow me to verify that the call is coming from my Android App and not another unauthorized one. I want my RESTful API to only work with the app I made and so no one can spoof it or access it unauthorized. Or is this an