jersey security and session management

Question

Hi,

Is there a way for session management or security available programatically in Jersey specification.

e.g. like a web-application session management.

Or is transaction, session, security all handeled by the containor on which the jersey application is deployed.

Adhir

Answer 1

Session management is the purview of the container in which Jersey is deployed. In most production cases, it will be deployed within a container that performs session management.

The code below is a simple example of a jersey resource that gets the session object and stores values in the session and retrieves them on subsequent calls.

@Path("/helloworld")
public class HelloWorld {

    @GET
    @Produces("text/plain")
    public String hello(@Context HttpServletRequest req) {

     HttpSession session= req.getSession(true);
     Object foo = session.getAttribute("foo");
     if (foo!=null) {
      System.out.println(foo.toString());
     } else {
      foo = "bar";
      session.setAttribute("foo", "bar");
     }
     return foo.toString();


    }
}

Answer 2

Jack's response about sessions is correct. They are specific to the container that you execute in, although the Servlet spec at least gives you portability between JavaEE containers.

As for security, you at least have the opportunity to separate it from your JAX-RS specific code by employing JaaS (Java Authentication and Authorization Service) and a servlet filter. The filter can be used to enforce HTTP authentication and, on successful auth, setup the JaaS Subject with the appropriate Principals. Your JAX-RS resources can check for the appropriate Principals on the Subject. Since you control the whole stack, you should be able to rely on an authenticated user in your resources (but do test this!), and you can enforce authorization based on the current operation in the resource code.

Answer 3

For Jersey security you should take a look on jersey OAuth support. OAuth perfectly fits when you expose API for your system to external users. For example like tr.im api or linkedin api

http://wikis.sun.com/display/Jersey/OAuth