Jersey Authentication

Question

I want to implement authentication for my Jersey-based REST server / client, but I'm not sure how to lay out the code.

In principle, for each operation I have 2 methods - 1 from the server, 1 from the client side.

I narrowed the algorithm - I'm going to use amazon strategy with HMAC.

The question is how to state this in the code - should I add authentication (encryption / decryption code) to each method - both on the server side and on the client side, or should I have one sending method on both sides that will execute encryption / decryption, and then transfer execution control to a more specialized version, so that I have 1 central place where authentication is performed on both the client and the server?

I want to hear your comments on this?

Answer 1

Client side:

You just need to create a ClientFilter and add it to the filter chain. You can have two (or more) clients, for example, one for authenticated requests and the other for other requests, so you should not waste resources.

see http://jersey.java.net/nonav/apidocs/1.12/jersey/com/sun/jersey/api/client/filter/ClientFilter.html

Server side:

As on the server side, you can implement Request / ResponseContainerFilter (s), which will handle authentication. These filters are global by default, but you can narrow the scope by implementing ResourceFilterFactory and then attach only to the corresponding resources (endpoints).

Or you could have 2 wars, one for “protected” resources and one for the other.

cm.
http://jersey.java.net/nonav/apidocs/1.12/jersey/com/sun/jersey/spi/container/ResourceFilterFactory.html
http://jersey.java.net/nonav/apidocs/1.12/jersey/com/sun/jersey/spi/container/ContainerRequestFilter.html
http://jersey.java.net/nonav/apidocs/1.12/jersey/com/sun/jersey/spi/container/ContainerResponseFilter.html