如何在Java（REST）应用程序中验证用户？

Question

I have some java server application and some WEB interface(jQuery). For REST services i'm using Jersey implementation. I can easily sent JSON to the server from WEB page and vice versa.

Example of my REST service:

@Path("/users")
public class User {

 @POST
 @Path("/login")
 @Consumes(MediaType.APPLICATION_JSON)
 public Response authUser(User user) {
   //code
 }
}

But there is one problem. How can I auth users? For example, i have some private resources: when user in not log in, he can't see it resource/web page, but when he logined(enter correct name and password) he can see it resource.

I didn't use sping application. I have googled a lot of time but I didn't find easy examples, then i tried to read Jose's Sandoval book "RESTful Java Web Services", in "Security" section a lot of useful information but there isn't examples.

Could you please help me?

Answer 1

There are different ways to approach this I believe. One way is that when the user authenticates, you send him back a token [which expires after some time] and he then passes back that token in subsequent calls.

Save the token to a file or db. In subsequent requests that come from client , compare token timestamp and value.

Once that token expires he has to re-authenticate.