restful-authentication | 易学教程

How to get Remote / Client IP address using RESTful web service in java?

阅读更多关于 How to get Remote / Client IP address using RESTful web service in java?

I have written Rest web service in my project.The web service call may come from different machine.so i need to find out the IP address through REST webservice. From this link request.getRemoteAddr() to use this. But i cant use getRemoteAddr(). Because my request and response are xml format. I have used post method in REST service.Tomcat server.I have send request as xml format. How can i get the IP address? Assuming you are using JAX-RS: @GET Produces("application/xlm") public String getData(@Context HttpServletRequest request){ String ip = request.getRemoteAddr(); } The @Context annotation

Why is form based authentication NOT considered RESTful?

阅读更多关于 Why is form based authentication NOT considered RESTful?

问题 Although I "think" I understand it I need some clarity. With PURE Restful authentication, things do get a bit unwieldy and using forms helps a lot with the UI of the application (i.e., get to have separate login page, forgot password links, easier logout? etc.,) Now Forms come along and some folks say "not restful" - what is "not restful" about them? Is it that there is no corresponding login resource so to speak? Or does it force something else that I'm missing? Note: If ones create sessions

User/Pass Authentication using RESTful WCF & Windows Forms

阅读更多关于 User/Pass Authentication using RESTful WCF & Windows Forms

What is the best approach to implementing authorisation/authentication for a Windows Forms app talking to an IIS-hosted RESTful WCF Service? The reason I ask is I am very confused, after sifting through different articles and posts expressing a different method and eventually hitting a ~650 page document on WCF Security Best Practices" ( http://www.codeplex.com/WCFSecurityGuide ) I am just uncertain which approach is the BEST to take and how to get started on implementation, given my scenario. I started with this article "A Guide to Designing and Building RESTful Web Services with WCF 3.5" (

Basic HTTP and Bearer Token Authentication

阅读更多关于 Basic HTTP and Bearer Token Authentication

问题 I am currently developing a REST-API which is HTTP-Basic protected for the development environment. As the real authentication is done via a token, I'm still trying to figure out, how to send two authorization headers. I have tried this one: curl -i http://dev.myapp.com/api/users \ -H "Authorization: Basic Ym9zY236Ym9zY28=" \ -H "Authorization: Bearer mytoken123" I could for example disable the HTTP-Authentication for my IP but as I usually work in different environments with dynamic IPs,

AngularJS Authentication + RESTful API

阅读更多关于 AngularJS Authentication + RESTful API

Angular+RESTful Client-side Communication w/ API for Auth/(re)Routing This has been covered in a few different questions, and in a few different tutorials, but all of the previous resources I've encountered don't quite hit the nail on the head. In a nut-shell, I need to Login via POST from http://client.foo to http://api.foo/login Have a "logged in" GUI/component state for the user that provides a logout route Be able to "update" the UI when the user logs out / logs out. This has been the most frustrating Secure my routes to check for authenticated-state (should they need it) and redirect the

Securing REST API using custom tokens (stateless, no UI, no cookies, no basic authentication, no OAuth, no login page)

阅读更多关于 Securing REST API using custom tokens (stateless, no UI, no cookies, no basic authentication, no OAuth, no login page)

问题 There are lots of guidelines, sample codes that show how to secure REST API with Spring Security, but most of them assume a web client and talk about login page, redirection, using cookie, etc. May be even a simple filter that checks for the custom token in HTTP header might be enough. How do I implement security for below requirements? Is there any gist/github project doing the same? My knowledge in spring security is limited, so if there is a simpler way to implement this with spring

Securing my Node.js app's REST API?

阅读更多关于 Securing my Node.js app's REST API?

问题 I could do with some help on my REST API. I'm writing a Node.js app which is using Express, MongoDB and has Backbone.js on the client side. I've spent the last two days trying to work out all of this and not having much luck. I've already checked out: Securing a REST API Securing my REST API with OAuth while still allowing authentication via third party OAuth providers (using DotNetOpenAuth) http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/ http://tesoriere

RESTful web service - how to authenticate requests from other services?

阅读更多关于 RESTful web service - how to authenticate requests from other services?

问题 I am designing a RESTful web service that needs to be accessed by users, but also other web services and applications. All of the incoming requests need to be authenticated. All communication takes place over HTTPS. User authentication is going to work based on an authentication token, acquired by POSTing the username and password (over an SSL connection) to a /session resource provided by the service. In the case of web service clients, there is no end user behind the client service. The

What is the most common way to authenticate a modern web app?

阅读更多关于 What is the most common way to authenticate a modern web app?

问题 I'm writing a wep app (rest api actually) using Spring, Spring Security. Right now I have basic and really straightforward auth using username, password and roles. I want to improve the security layer but I've no any experience at this. When I had looked at postman for possible auth methods and researched google I've seen the given options: API key Bearer Token Basic Auth Digest Auth OAuth 1.0 OAuth 2.0 Hawk Auth AWS Signature NTLM Auth Digest, Hawk, AWS and NTLM seem like to be really

setRequestHeader does not work in JSONP using jQuery

阅读更多关于 setRequestHeader does not work in JSONP using jQuery

问题 I am building an iPhone app using jQuery Mobile, jQuery 1.7.2, and PhoneGap trying to get a JSONP from ASP.NET RESTful web service using this code, problem that I need to authenticate first and get a token, then send it back again. here is my function: var setToken = function () { var serverToken = ''; $.support.cors = true; jQuery('body').ajaxSend(function (evt, xhr) { xhr.setRequestHeader("Authorization", "Basic " + $.base64.encode(username + ":" + password)); xhr.setRequestHeader('X-Accept