Sample about RESTful and Shiro Integration

Question

I am developing a Java web application using RESTful as web service. And now I want to apply Apache Shiro to secure my application. The mechanism is: after user logged in successfully, a token (combined from username, password and logged time) will be returned to client. Then every single REST request will attach this token to authenticate at server (no need to authorize). But now I dont know how to configure to accept this.
And by the way, could you please give me any sample about Shiro & RESTful integration? Thank you

Answer 1

If the REST application and the Java web application are the same Webapp, then you only need to check subject.isAuthenticated(). Use a session cookie without the password or username (it isn't a good idea to be passing around the password as it could be stolen).

Most of this behavior comes by default if both parts are in the same Webapp.

In your REST method you'd have something like:

Subject subject = SecurityUtils.getSubject();
if(subject == null || !subject.isAuthenticated()) {
     return 401; // Not Authorized
}

Hope that helps.