Securing Your Applications Running on Payara Platform (JAX-RS Endpoints)

Security

Securing your application is a very important aspect of the development of your application. You not only need to make sure that the application has the intended functionality but also that this functionality can only be executed by the appropriate people. You not only need to make sure that updates to data are restricted to the correct people, but it is also important that end users only see data they are allowed to see. And in case of sensitive data, this is even more important.

When your application is based on REST endpoints, securing the application is even more challenging. Those endpoints are in most cases called by some front end, written in all types of technologies ranging from browser-based to native mobile apps, and thus you can’t ask for a user name and password when they are called. They are also stateless, they don’t keep track of previous calls. So we need to provide them all the information about the user in a secure way, every time.

This User Guide will discuss the different aspects of securing the JAX-RS endpoints of your application using standards and common practices like OAuth2, OpenID Connect, JWT Tokens, and MicroProfile JWT authentication in combination with the Payara Platform.

Security is one of the major aspects of the application that needs to be addressed. When using REST endpoints this imposes an additional challenge. How can user information be passed on in a secure way and in a format that the microservice can validate with additional remote calls?

By using JWT tokens that contain claims about the user identity and authorization, we can make sure that this information is passed in a way that rules out tampering. We will also discuss the usage of an OpenID Connect provider to supply these tokens instead of generating them yourself.

In the second half of the guide, a detailed description of an application is will be given to use such JWT tokens and how these tokens can be passed on to other microservices.

{{cta(‘ce3578a9-acc6-4efc-9445-065ec2efc16e’)}}

 

Comments (2)

Post a comment

Your email address will not be published. Required fields are marked *

Payara needs the contact information you provide to us to contact you about our products and services. You may unsubscribe from these communications at any time. For information on how to unsubscribe, as well as our privacy practices and commitment to protecting your privacy, please review our Legal & Privacy Policy.

  1. Slavisa Paunovic

    Is there sample code? When implement my sample I get – Unauthorized This request requires HTTP authentication.

  2. Jadon Ortlepp

    Hi Slavisa,
    Just to check, is this from implementing the example on page 7?

Related Posts

Payara Qube-Cloud Light banner 4 minutes
Security

Zero Trust Security in Enterprise Java: What it is and How to Implement it

Cybersecurity isn’t just about building walls, fortresses, moats or any other external barrier anymore. Nowadays, it’s important to check […]

Understanding the Security Issues of Aging Middleware 8 minutes
Security

Understanding the Security Issues of Aging Middleware

Middleware runs quietly in the background of most applications, which makes it easy to overlook its lifecycle. In effect, […]

Securing Jakarta EE Application Servers Needs Executive Attention 3 minutes
Jakarta EE

Securing Jakarta EE Application Servers Needs Executive Attention

If your organization runs Jakarta EE applications, securing the application server they rely on is not a one-time project. […]