Win a copy of Reactive Streams in Java: Concurrency with RxJava, Reactor, and Akka Streams this week in the Reactive Progamming forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Liutauras Vilda
  • Junilu Lacar
  • Jeanne Boyarsky
  • Bear Bibeault
Sheriffs:
  • Knute Snortum
  • Tim Cooke
  • Devaka Cooray
Saloon Keepers:
  • Ron McLeod
  • Stephan van Hulst
  • Tim Moores
  • Tim Holloway
  • Carey Brown
Bartenders:
  • Piet Souris
  • Frits Walraven
  • Ganesh Patekar

Secure REST APIs

 
Ranch Hand
Posts: 333
Scala Spring Java
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi Ranchers,

I am currently working on a Security POC where in we are using JWT for token based security
This POC later will be integrated later in my actual project.

What are the best strategies to make my REST calls and REST API secure?

Actual Project already have OAuth 2 Token based Security.

I am already using HTTPS Protocol.

Request you to help me with the same.

Regards,
-Pankaj.



 
Saloon Keeper
Posts: 10649
227
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
It depends on what framework you're using for the actual REST application. I'd use established middleware for that framework. For instance, if the application is built on Spring, I'd use Spring Security's JWT provisions.
 
Pankaj Shet
Ranch Hand
Posts: 333
Scala Spring Java
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator

Thanks for your reply Stephan.

It is using Spring platform, but we are not using Spring Security.

What we are doing is explained in brief:

Everytime the user logs in, the User credentials are verified from db and JWT tokens are sent back to user.
Every subsequent request which is not the login request is intercepted by the spring HandlerInterceptor which does the job of verifying the tokenstring, parsing the claims.
If claims are formed succcessfully, the request is processed further else it is not.
We are using https request..!

So now I want to understand why would I have to integrate OAUTH2, OpenID and Spring Security,  what are the advantages of using each.

Apart from above if anything is found more secure please suggest.

I want to make REST API Ultra secure.

Please help me out for the same.

Regards,
-Pankaj.
 
Rancher
Posts: 493
6
IntelliJ IDE Spring Fedora
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
The reason you would use spring security is because you already have spring all set up, it would be trivial to add spring security and it would save you alot of time because it's already implemented well.
 
Your mother was a hamster and your father was a tiny ad:
Java file APIs (DOC, XLS, PDF, and many more)
https://products.aspose.com/total/java
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
Boost this thread!