Securing Your Applications Running on Payara Platform (JAX-RS Endpoints)

Security

Securing your application is a very important aspect of the development of your application. You not only need to make sure that the application has the intended functionality but also that this functionality can only be executed by the appropriate people. You not only need to make sure that updates to data are restricted to the correct people, but it is also important that end users only see data they are allowed to see. And in case of sensitive data, this is even more important.

When your application is based on REST endpoints, securing the application is even more challenging. Those endpoints are in most cases called by some front end, written in all types of technologies ranging from browser-based to native mobile apps, and thus you can’t ask for a user name and password when they are called. They are also stateless, they don’t keep track of previous calls. So we need to provide them all the information about the user in a secure way, every time.

This User Guide will discuss the different aspects of securing the JAX-RS endpoints of your application using standards and common practices like OAuth2, OpenID Connect, JWT Tokens, and MicroProfile JWT authentication in combination with the Payara Platform.

Security is one of the major aspects of the application that needs to be addressed. When using REST endpoints this imposes an additional challenge. How can user information be passed on in a secure way and in a format that the microservice can validate with additional remote calls?

By using JWT tokens that contain claims about the user identity and authorization, we can make sure that this information is passed in a way that rules out tampering. We will also discuss the usage of an OpenID Connect provider to supply these tokens instead of generating them yourself.

In the second half of the guide, a detailed description of an application is will be given to use such JWT tokens and how these tokens can be passed on to other microservices.

{{cta(‘ce3578a9-acc6-4efc-9445-065ec2efc16e’)}}

 

Comments (2)

Post a comment

Your email address will not be published. Required fields are marked *

Payara needs the contact information you provide to us to contact you about our products and services. You may unsubscribe from these communications at any time. For information on how to unsubscribe, as well as our privacy practices and commitment to protecting your privacy, please review our Legal & Privacy Policy.

  1. Slavisa Paunovic

    Is there sample code? When implement my sample I get – Unauthorized This request requires HTTP authentication.

  2. Jadon Ortlepp

    Hi Slavisa,
    Just to check, is this from implementing the example on page 7?

Related Posts

The Imperative for Legacy Java Modernization in Banking Cover 2 minutes
Security

The $57 Billion Problem: Why Banking’s Java Legacy Crisis Demands Immediate Action

How outdated Java systems are draining budgets and throttling innovation across financial services? Let’s dig in in this blog […]

Interview The software that could be putting your cyber-security at risk 2 minutes
Security

Middleware Cyber Security: The Hidden Risk Every C-Suite Should Prioritize

When tackling cyber risk at the strategic level, it pays to learn from trusted leaders. Steve Millidge, CEO and […]

Graphic promoting the Jakarta EE Agentic AI Project by Payara Community. The design shows a laptop screen with a central icon of a person wearing headphones and using a laptop, surrounded by sparkles. The background features blue ocean-themed elements with coral and small fish. Logos for Jakarta EE and Payara Community appear at the top. 3 minutes
Community

Announcing the Jakarta Agentic AI Project

Exploring the Future of AI with the Jakarta EE Community At Payara, we’re passionate about pushing the boundaries of […]