Secure REST APIs

[Pankaj Shet]

Hi Ranchers,

I am currently working on a Security POC where in we are using JWT for token based security
This POC later will be integrated later in my actual project.

What are the best strategies to make my REST calls and REST API secure?

Actual Project already have OAuth 2 Token based Security.

I am already using HTTPS Protocol.

Request you to help me with the same.

Regards,
-Pankaj.

[Stephan van Hulst]

It depends on what framework you're using for the actual REST application. I'd use established middleware for that framework. For instance, if the application is built on Spring, I'd use Spring Security's JWT provisions.

[Pankaj Shet]

Thanks for your reply Stephan.

It is using Spring platform, but we are not using Spring Security.

What we are doing is explained in brief:

Everytime the user logs in, the User credentials are verified from db and JWT tokens are sent back to user.
Every subsequent request which is not the login request is intercepted by the spring HandlerInterceptor which does the job of verifying the tokenstring, parsing the claims.
If claims are formed succcessfully, the request is processed further else it is not.
We are using https request..!

So now I want to understand why would I have to integrate OAUTH2, OpenID and Spring Security,  what are the advantages of using each.

Apart from above if anything is found more secure please suggest.

I want to make REST API Ultra secure.

Please help me out for the same.

Regards,
-Pankaj.

[Al Hobbs]

The reason you would use spring security is because you already have spring all set up, it would be trivial to add spring security and it would save you alot of time because it's already implemented well.