search

cathive / fx-pastebin

Pastebin app for JavaFX
1 stars 0 forks source link

Security layer #9

Open aerben opened 10 years ago

aerben commented 10 years ago

Right now, we only have a very rudimentary user profile entity and no security for our REST interface. That'll have to change soon. Which security framework for our REST interface should we use?

headcr4sh commented 10 years ago

I think for role-based security constraints we can already rely on container-managed roles via @javax.annotation.security.* annotations. They should be working out of the box or can be enabled easily by modifying the RestApplication class in the fx-pastebin-server module.

For fine-grained stuff (e.g. a user should be able to change his/her own profile but not the profile of another user) we might rely on the SecurityContext that JAX-RS2.0 has to offer: https://jersey.java.net/documentation/latest/security.html (documentation of the JAX-RS reference implementation [RI] a.k.a. "Jersey").

Maybe a filter ( https://jersey.java.net/documentation/latest/filters-and-interceptors.html) might be all that is needed for fine-grained access control...

aerben commented 10 years ago

We could also use Spring Security which I already know quite well. But I'll have a closer look into the links you posted - maybe the JAX-RS-solutions are suited well enough. SS would have the disadvantage of the (small) Spring Container overhead - and we would stray from the just-Java EE-path.