<div dir="ltr">Dear fellow developers,<div><br></div><div>I am building a small web framework based on Jax-rs (Resteasy) and undertow (with undertow-servlet) and I am having interrogations about authenticating requests...</div><div>First of all, I know I shouldn't re-invent the wheel and build another framework from scratch, but I am doing it purely for educational purposes (my education!)</div><div><br></div><div>The setup is very simple: an embedded servlet container (undertow), bootstrapping one single jax-rs servlet (resteasy), with little glue around all of this et voilà! The user (person using the framework) only has to focus on his jax-rs resources.</div><div><br></div><div>The servlet api already specifies how authentication should be done, and undertow implements it and I am not here to question that. </div><div>However, what I want to achieve is to delegate all the authentication logic to the Jax-rs layer.</div><div>I see two advantages in this:</div><div>- The user has full control over the login / user management system, without having to tweak the servlet deployment... He can decide to do logins against a DB, a remote web service etc... all programatically.</div><div>- Use the Jax-rs "DynamicFeature" feature.. to control what resources have to be secured. To illustrate it, here is a code sample of how I intend to use the DynamicFeature:</div><div><br></div><div><div><font color="#0000ff" size="1"><b>@Provider</b></font></div><div><font color="#0000ff" size="1"><b>public class AuthenticationNeededFeature implements DynamicFeature {</b></font></div><div><font color="#0000ff" size="1"><b><br></b></font></div><div><font color="#0000ff" size="1"><b> @Inject</b></font></div><div><font color="#0000ff" size="1"><b> private AuthenticationFilter authenticationFilter;</b></font></div><div><font color="#0000ff" size="1"><b> </b></font></div><div><font color="#0000ff" size="1"><b> @Override</b></font></div><div><font color="#0000ff" size="1"><b> public void configure(ResourceInfo resourceInfo, FeatureContext context) {</b></font></div><div><font color="#0000ff" size="1"><b><br></b></font></div><div><font color="#0000ff" size="1"><b> /* If resource is not public then we add the authentication filter */</b></font></div><div><font color="#0000ff" size="1"><b> if (!resourceInfo.getResourceMethod().isAnnotationPresent(Public.class)) {</b></font></div><div><font color="#0000ff" size="1"><b> context.register(authenticationFilter);</b></font></div><div><font color="#0000ff" size="1"><b> }</b></font></div><div><font color="#0000ff" size="1"><b> }</b></font></div><div><font color="#0000ff" size="1"><b>}</b></font></div></div><div><br></div><div><div>This simply checks if the targeted resource method has the annotation Public on it (custom annotation). If not, the resource must then be authenticated and a ContainerRequestFilter is registered, to apply the authentication logic.</div><div><br></div><div>The user can do anything he wants to authenticate the request inside the filter:</div><div>- Look in a custom Authorization header for a bearer token</div><div>- Validate the token against a db or a cache</div><div>- Play with cookies</div><div><br></div><div>And more importantly, the securityContext, can be set here, as the Request object is available.</div><div>The user can manufacture a securityContext containing the current user's principal and roles (after a successful authentication of the request) and therefore enable the role based access control in the resources (@RolesAllowed).</div><div><br></div><div>I had a little try with adding a ServletExtension into the deployment, with a custom AuthenticationMechanism, but I couldn't achieve what is described above, as it is really jax-rs specific.</div><div><br></div><div>I haven't seen a lot of people on the internet doing what I have described above... that's why I am not that confident! I am indeed bypassing all the security layer already available in Undertow. I feel I am missing the elephant in the room...</div><div><br></div><div>What do you think about that approach?</div><div><br></div><div>Thank you all in advance.</div><div><br></div><div>Best regards,</div><div>Antoine</div>
</div></div>