一个Java Web应用程序中可以有两种认证机制吗？

Question

I have a web application that contains ui based on jsf 2.0 and a set of rest apis. The ui side of the application is accessed from a browser and rest apis are invoked from a mobile app.

For the authentication for the UI is managed by jsf , (no form nothing, jsf manages everything). Now, I want the user to be authenticated before he/she can access the rest apis.

Can I set up the web application to have Basic authentication so that I can set the username and password in the header when calling the rest apis?

Answer 1

You will need to have a security filter for your web application. (this can be done with spring security - Integrating Spring security with JSF 2 )

The user will have to pass a username and password to your application.

Then, you just need to configure your rest api to work with basic authentication. Since basic authentication is a HTTP feature, every time you call the rest service, you will need to pass the username/password in the request.