原文： https://howtodoinjava.com/jersey/jersey-rest-security/

在此 Jersey rest 安全示例中，我们将学习通过基本认证保护 Jersey REST API 的安全。 这将强制每个用户提供用户名/密码以认证到门户。 另外，用户还必须具有一定级别的角色。 我从为 RESTEasy API 安全性创建的另一个示例扩展了此示例，并使用ContainerRequestFilter实现在用户登陆实际的 REST API 之前验证其访问权限。

  1. Table of Contents
  3. 1\. Create request authentication filter
  4. 2\. Register AuthenticationFilter with ResourceConfig
  5. 3\. Secure REST APIs
  6. 4\. Test Jersey AuthenticationFilter

1. 创建请求认证过滤器

我们知道 JAX-RS 2.0 具有用于处理请求前和请求的过滤器，因此我们将使用ContainerRequestFilter接口。 在此过滤器中，我们将获取请求尝试访问的方法的详细信息。

我们将找出该方法上所有与安全性相关的配置，并在此过滤器中验证所有内容，例如，注解，例如@PermitAll，@DenyAll或@RolesAllowed。

根据方法上的注解，我们将决定是通过还是阻止请求。

  1. package com.howtodoinjava.jersey.provider;
  3. import java.lang.reflect.Method;
  4. import java.util.Arrays;
  5. import java.util.HashSet;
  6. import java.util.List;
  7. import java.util.Set;
  8. import java.util.StringTokenizer;
  10. import javax.annotation.security.DenyAll;
  11. import javax.annotation.security.PermitAll;
  12. import javax.annotation.security.RolesAllowed;
  13. import javax.ws.rs.container.ContainerRequestContext;
  14. import javax.ws.rs.container.ResourceInfo;
  15. import javax.ws.rs.core.Context;
  16. import javax.ws.rs.core.MultivaluedMap;
  17. import javax.ws.rs.core.Response;
  18. import javax.ws.rs.ext.Provider;
  20. import org.glassfish.jersey.internal.util.Base64;
  22. /**
  23.  * This filter verify the access permissions for a user
  24.  * based on username and passowrd provided in request
  25.  * */
  26. @Provider
  27. public class AuthenticationFilter implements javax.ws.rs.container.ContainerRequestFilter
  28. {
  30.     @Context
  31.     private ResourceInfo resourceInfo;
  33.     private static final String AUTHORIZATION_PROPERTY = "Authorization";
  34.     private static final String AUTHENTICATION_SCHEME = "Basic";
  36.     @Override
  37.     public void filter(ContainerRequestContext requestContext)
  38.     {
  39.         Method method = resourceInfo.getResourceMethod();
  40.         //Access allowed for all
  41.         if( ! method.isAnnotationPresent(PermitAll.class))
  42.         {
  43.             //Access denied for all
  44.             if(method.isAnnotationPresent(DenyAll.class))
  45.             {
  46.                 requestContext.abortWith(Response.status(Response.Status.FORBIDDEN)
  47.                          .entity("Access blocked for all users !!").build(););
  48.                 return;
  49.             }
  51.             //Get request headers
  52.             final MultivaluedMap<String, String> headers = requestContext.getHeaders();
  54.             //Fetch authorization header
  55.             final List<String> authorization = headers.get(AUTHORIZATION_PROPERTY);
  57.             //If no authorization information present; block access
  58.             if(authorization == null || authorization.isEmpty())
  59.             {
  60.                 requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED)
  61.                     .entity("You cannot access this resource").build());
  62.                 return;
  63.             }
  65.             //Get encoded username and password
  66.             final String encodedUserPassword = authorization.get(0).replaceFirst(AUTHENTICATION_SCHEME + " ", "");
  68.             //Decode username and password
  69.             String usernameAndPassword = new String(Base64.decode(encodedUserPassword.getBytes()));;
  71.             //Split username and password tokens
  72.             final StringTokenizer tokenizer = new StringTokenizer(usernameAndPassword, ":");
  73.             final String username = tokenizer.nextToken();
  74.             final String password = tokenizer.nextToken();
  76.             //Verifying Username and password
  77.             System.out.println(username);
  78.             System.out.println(password);
  80.             //Verify user access
  81.             if(method.isAnnotationPresent(RolesAllowed.class))
  82.             {
  83.                 RolesAllowed rolesAnnotation = method.getAnnotation(RolesAllowed.class);
  84.                 Set<String> rolesSet = new HashSet<String>(Arrays.asList(rolesAnnotation.value()));
  86.                 //Is user valid?
  87.                 if( ! isUserAllowed(username, password, rolesSet))
  88.                 {
  89.                     requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED)
  90.                         .entity("You cannot access this resource").build(););
  91.                     return;
  92.                 }
  93.             }
  94.         }
  95.     }
  96.     private boolean isUserAllowed(final String username, final String password, final Set<String> rolesSet)
  97.     {
  98.         boolean isAllowed = false;
  100.         //Step 1\. Fetch password from database and match with password in argument
  101.         //If both match then get the defined role for user from database and continue; else return isAllowed [false]
  102.         //Access the database and do this part yourself
  103.         //String userRole = userMgr.getUserRole(username);
  105.         if(username.equals("howtodoinjava") && password.equals("password"))
  106.         {
  107.             String userRole = "ADMIN";
  109.             //Step 2\. Verify user role
  110.             if(rolesSet.contains(userRole))
  111.             {
  112.                 isAllowed = true;
  113.             }
  114.         }
  115.         return isAllowed;
  116.     }
  117. }

2. 向ResourceConfig注册AuthenticationFilter

现在，您需要在ResourceConfig实例上方注册过滤器。 因此，创建一个如下所示的实例：

  1. package com.howtodoinjava.jersey;
  3. import org.glassfish.jersey.filter.LoggingFilter;
  4. import org.glassfish.jersey.server.ResourceConfig;
  5. import com.howtodoinjava.jersey.provider.AuthenticationFilter;
  6. import com.howtodoinjava.jersey.provider.GsonMessageBodyHandler;
  8. public class CustomApplication extends ResourceConfig 
  9. {
  10.     public CustomApplication() 
  11.     {
  12.         packages("com.howtodoinjava.jersey");
  13.         register(LoggingFilter.class);
  14.         register(GsonMessageBodyHandler.class);
  16.         //Register Auth Filter here
  17.         register(AuthenticationFilter.class);
  18.     }
  19. }

并将此资源配置添加到web.xml文件中。

  1. <!DOCTYPE web-app PUBLIC
  2.  "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
  3.  "http://java.sun.com/dtd/web-app_2_3.dtd" >
  5. <web-app>
  7.     <display-name>Archetype Created Web Application</display-name>
  9.     <servlet>
  10.         <servlet-name>jersey-serlvet</servlet-name>
  11.         <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
  12.         <init-param>
  13.             <param-name>javax.ws.rs.Application</param-name>
  14.             <param-value>com.howtodoinjava.jersey.CustomApplication</param-value>
  15.         </init-param>
  16.         <load-on-startup>1</load-on-startup>
  17.     </servlet>
  19.     <servlet-mapping>
  20.         <servlet-name>jersey-serlvet</servlet-name>
  21.         <url-pattern>/rest/*</url-pattern>
  22.     </servlet-mapping>
  24. </web-app>

3. 安全的 REST API

现在是时候保护 REST API 了。 如下使用标准的 JAX-RS 注解。

  1. @Path("/employees")
  2. public class JerseyService 
  3. {
  4.     @RolesAllowed("ADMIN")
  5.     @GET
  6.     @Produces(MediaType.APPLICATION_JSON)
  7.     @Consumes(MediaType.APPLICATION_JSON)
  8.     public Employees getAllEmployees() 
  9.     {
  10.         Employees list = new Employees();
  11.         list.setEmployeeList(new ArrayList<Employee>());
  13.         list.getEmployeeList().add(new Employee(1, "Lokesh Gupta"));
  14.         list.getEmployeeList().add(new Employee(2, "Alex Kolenchiskey"));
  15.         list.getEmployeeList().add(new Employee(3, "David Kameron"));
  17.         return list;
  18.     }
  19. }

4. 测试 Jersey AuthenticationFilter

让我们测试认证设置是否有效。

点击 URL：http://localhost:8080/JerseyDemos/rest/employees

Jersey REST API 安全示例 - 图1

Jersey 认证失败的请求

在基本认证参数中传递用户名和密码：howtodoinjava/password

Jersey REST API 安全示例 - 图2

Jersey 认证成功的请求

单击下面的链接下载 jersey rest api 认证示例应用的源代码。

JerseyDemos

学习愉快！