java OAuth JAXR设置安全网页

3 月，2 周 Questions & Answers 487

我有一个JAX-RS项目，我需要用OAuth保护一个特定的页面，如果可能的话，我希望所有的东西都在一个类中

关于我搜索的内容，似乎没有合适的指南或教程

以下是我迄今为止尝试过的：

原始类别：

 @Path("/topsecret")
 @Produces(MediaType.TEXT_PLAIN)
 public class TopSecretRestService extends AbstractRestService {

  @GET
  @Path("/")
   public Response getSecret() {
       String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
       return Response.status(200).entity(output).build();

   }
}

StipleSoft的解决方案：（每件事都会出错）

@Path("/topsecret")
@Produces(MediaType.TEXT_PLAIN)
public class TopSecretRestService extends AbstractRestService {

    @Path("/")
    @GET
    public Response authorize(@Context HttpServletRequest request)
            throws URISyntaxException, OAuthSystemException {
        try {
            OAuthAuthzRequest oauthRequest =
                new OAuthAuthzRequest(request);
            OAuthIssuerImpl oauthIssuerImpl =
                new OAuthIssuerImpl(new MD5Generator());

            //build response according to response_type
            String responseType =
                oauthRequest.getParam(OAuth.OAUTH_RESPONSE_TYPE);

            OAuthASResponse.OAuthAuthorizationResponseBuilder builder =
                    OAuthASResponse.authorizationResponse(request,
                        HttpServletResponse.SC_FOUND);

            // 1
            if (responseType.equals(ResponseType.CODE.toString())) {
                final String authorizationCode =
                    oauthIssuerImpl.authorizationCode();
                database.addAuthCode(authorizationCode);
                builder.setCode(authorizationCode);
            }

            String redirectURI =
                oauthRequest.getParam(OAuth.OAUTH_REDIRECT_URI);
            final OAuthResponse response = builder
                .location(redirectURI)
                .buildQueryMessage();
            URI url = new URI(response.getLocationUri());
            return Response.status(response.getResponseStatus())
                .location(url)
                .build();

            String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
            return Response.status(200).entity(output).build();


        } catch (OAuthProblemException e) {
            // ...
        }
}

}

谷歌的解决方案（似乎最简单，但找不到合适的罐子）

@GET
@Path("/")
public Response getSecret() {

    OAuthService oauth = OAuthServiceFactory.getOAuthService();
    String scope = "https://www.googleapis.com/auth/userinfo.email";
    Set<String> allowedClients = new HashSet<>();
    allowedClients.add("407408718192.apps.googleusercontent.com"); // list your client ids here

    try {
      User user = oauth.getCurrentUser(scope);
      String tokenAudience = oauth.getClientId(scope);
      if (!allowedClients.contains(tokenAudience)) {
        throw new OAuthRequestException("audience of token '" + tokenAudience
            + "' is not in allowed list " + allowedClients);
      }
      // proceed with authenticated user
        String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
        return Response.status(200).entity(output).build();
    } catch (OAuthRequestException ex) {
      // handle auth error
      // ...
    } catch (OAuthServiceFailureException ex) {
      // optionally, handle an oauth service failure
      // ...
    }

}

网站和其他问题：

Securing jax-rs with OAuth——提问者提供的答案非常简短，没有细节

Jax RS REST API - OAuth 2.0 and Control Origin——asker提供的答案，不是同一个问题

http://cxf.apache.org/docs/jax-rs-oauth2.html关于jax rs与oauth2的教程

注意：我对OAuth和jax rs都很陌生

Python中文网

有 Java 编程相关的问题?

java OAuth JAXR设置安全网页

共 (1) 个答案

# 1 楼答案