Java Jax-RS (Jersey) Backend & jQuery Frontend & # 8594; Security + Session

Question

I am currently developing a lightweight web application using Jax-RS on the server side (deployed in the tomcat 7 container) and HTML5, CSS3 and jQuery in the interface.

The connection is working fine. I do not know how to protect the application. My idea is that the user can register through the interface and is assigned the default role (for example, users).

From this moment, the user can log in to the website and, for example, register for a course or something like that.

How can this be done in a safe way? Is it better to use tomcats authentication (DIGEST or FORM)? Or is there another way? How, for example, passing the user and password as an MD5 hash in each request?

It would be great if I could use @RolesAllowed Annotation in the Ressource Class to annotate methods that should only be available to specific groups.

And how can I store user data on the client? To prevent the user from logging in after each request? Should I use cookies for this?

One more thing, I'm not sure how to store data from the shopping cart. Would it be nice to use a DB table on the server, where do I store the contents of the basket for a specific user? How do I identify a user? What will the comparison between the registered user and the entrance to the basket in the table look like?

I hope someone can help me :-).

Thank you in advance

greets

Answer 1

I would use FORM authentication as you suggest. You can create context security restrictions using role annotations.

To save user information as a basket, save it in a session object, and then serialize to disk or database after the expiration date for further stability.

Answer 2

I did this on several systems using a session cookie. An @Context HttpServletRequest way is to add @Context HttpServletRequest as a parameter for each server-side Jersey-fied method, and it will be there to capture the session. In my case, I have a security handler (similar to Syro, but without its baggage) that places the wrapped user session in the context of the stream as a Tomcat filter, so I do not use the @Context HttpServletRequest annotation. If a user tries to access a residual resource by an identifier that is not available to them, he does not receive a response.