{"id":29571,"date":"2014-09-01T22:00:33","date_gmt":"2014-09-01T19:00:33","guid":{"rendered":"http:\/\/www.javacodegeeks.com\/?p=29571"},"modified":"2014-09-01T07:26:07","modified_gmt":"2014-09-01T04:26:07","slug":"secure-rest-services-using-spring-security","status":"publish","type":"post","link":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html","title":{"rendered":"Secure REST services using Spring Security"},"content":{"rendered":"<h2>Overview<\/h2>\n<p>Recently, I was working on a project which uses a REST services layer to communicate with the client application (GWT application). So I have spent a lot of to time to figure out how to secure the REST services with Spring Security. This article describe the solution I found, and I have implemented. I hope that this solution will be helpful to someone and will save a much valuable time.<br \/>\n&nbsp;<br \/>\n&nbsp;<br \/>\n&nbsp;<br \/>\n&nbsp;<\/p>\n<h2>The solution<\/h2>\n<p>In a normal web application, whenever a secured resource is accessed Spring Security check the security context for the current user and will decide either to forward him to login page (if the user is not authenticated), or to forward him to the resource not authorised page (if he doesn\u2019t have the required permissions).<\/p>\n<p>In our scenario this is different, because we don\u2019t have pages to forward to, we need to adapt and override Spring Security to communicate using HTTP protocols status only, below I liste the things to do to make Spring Security works best :<\/p>\n<ul>\n<li>The authentication is going to be managed by the normal form login, the only difference is that the response will be on JSON along with an HTTP status which can either code 200 (if the autentication passed) or code 401 (if the authentication failed) ;<\/li>\n<li>Override the <strong>AuthenticationFailureHandler<\/strong> to return the code 401 UNAUTHORIZED ;<\/li>\n<li>Override the <strong>AuthenticationSuccessHandler<\/strong> to return the code 20 OK, the body of the HTTP response contain the JSON data of the current authenticated user ;<\/li>\n<li>Override the <strong>AuthenticationEntryPoint<\/strong> to always return the code 401 UNAUTHORIZED. This will override the default behavior of Spring Security which is forwarding the user to the login page if he don\u2019t meet the security requirements, because on REST we don\u2019t have any login page ;<\/li>\n<li>Override the <strong>LogoutSuccessHandler<\/strong> to return the code 20 OK ;<\/li>\n<\/ul>\n<p>Like a normal web application secured by Spring Security, before accessing a protected service, it is mandatory to first authenticate by submitting the password and username to the Login URL.<\/p>\n<p><strong>Note:<\/strong> The following solution requires Spring Security in version minimum 3.2.<\/p>\n<h2>Overriding the AuthenticationEntryPoint<\/h2>\n<p>Class extends org.springframework.security.web.AuthenticationEntryPoint, and implements only one method, which sends response error (with 401 status code) in cause of unauthorized attempt.<\/p>\n<pre class=\" brush:java\">@Component\r\npublic class HttpAuthenticationEntryPoint implements AuthenticationEntryPoint {\r\n    @Override\r\n    public void commence(HttpServletRequest request, HttpServletResponse response,\r\n            AuthenticationException authException) throws IOException {\r\n        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, authException.getMessage());\r\n    }\r\n}<\/pre>\n<h2>Overriding the AuthenticationSuccessHandler<\/h2>\n<p>The AuthenticationSuccessHandler is responsible of what to do after a successful authentication, by default it will redirect to an URL, but in our case we want it to send an HTTP response with data.<div style=\"display:inline-block; margin: 15px 0;\"> <div id=\"adngin-JavaCodeGeeks_incontent_video-0\" style=\"display:inline-block;\"><\/div> <\/div><\/p>\n<pre class=\" brush:java\">@Component\r\npublic class AuthSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {\r\n    private static final Logger LOGGER = LoggerFactory.getLogger(AuthSuccessHandler.class);\r\n\r\n    private final ObjectMapper mapper;\r\n\r\n    @Autowired\r\n    AuthSuccessHandler(MappingJackson2HttpMessageConverter messageConverter) {\r\n        this.mapper = messageConverter.getObjectMapper();\r\n    }\r\n\r\n    @Override\r\n    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,\r\n            Authentication authentication) throws IOException, ServletException {\r\n        response.setStatus(HttpServletResponse.SC_OK);\r\n\r\n        NuvolaUserDetails userDetails = (NuvolaUserDetails) authentication.getPrincipal();\r\n        User user = userDetails.getUser();\r\n        userDetails.setUser(user);\r\n\r\n        LOGGER.info(userDetails.getUsername() + \" got is connected \");\r\n\r\n        PrintWriter writer = response.getWriter();\r\n        mapper.writeValue(writer, user);\r\n        writer.flush();\r\n    }\r\n}<\/pre>\n<h2>Overriding the AuthenticationFailureHandler<\/h2>\n<p>The AuthenticationFaillureHandler is responsible of what to after a failed authentication, by default it will redirect to the login page URL, but in our case we just want it to send an HTTP response with the 401 UNAUTHORIZED code.<\/p>\n<pre class=\" brush:java\">@Component\r\npublic class AuthFailureHandler extends SimpleUrlAuthenticationFailureHandler {\r\n    @Override\r\n    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,\r\n            AuthenticationException exception) throws IOException, ServletException {\r\n        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);\r\n\r\n        PrintWriter writer = response.getWriter();\r\n        writer.write(exception.getMessage());\r\n        writer.flush();\r\n    }\r\n}<\/pre>\n<h2>Overriding the LogoutSuccessHandler<\/h2>\n<p>The LogoutSuccessHandler decide what to do if the user logged out successfully, by default it will redirect to the login page URL, because we don\u2019t have that I did override it to return an HTTP response with the 20 OK code.<\/p>\n<pre class=\" brush:java;wrap-lines:false\">@Component\r\npublic class HttpLogoutSuccessHandler implements LogoutSuccessHandler {\r\n    @Override\r\n    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)\r\n            throws IOException {\r\n        response.setStatus(HttpServletResponse.SC_OK);\r\n        response.getWriter().flush();\r\n    }\r\n}<\/pre>\n<h2>Spring security configuration<\/h2>\n<p>This is the final step, to put all what we did together, I prefer using the new way to configure Spring Security which is with Java no XML, but you can easily adapt this configuration to XML.<\/p>\n<pre class=\" brush:java;wrap-lines:false\">@Configuration\r\n@EnableWebSecurity\r\npublic class WebSecurityConfig extends WebSecurityConfigurerAdapter {\r\n    private static final String LOGIN_PATH = ApiPaths.ROOT + ApiPaths.User.ROOT + ApiPaths.User.LOGIN;\r\n\r\n    @Autowired\r\n    private NuvolaUserDetailsService userDetailsService;\r\n    @Autowired\r\n    private HttpAuthenticationEntryPoint authenticationEntryPoint;\r\n    @Autowired\r\n    private AuthSuccessHandler authSuccessHandler;\r\n    @Autowired\r\n    private AuthFailureHandler authFailureHandler;\r\n    @Autowired\r\n    private HttpLogoutSuccessHandler logoutSuccessHandler;\r\n\r\n    @Bean\r\n    @Override\r\n    public AuthenticationManager authenticationManagerBean() throws Exception {\r\n        return super.authenticationManagerBean();\r\n    }\r\n\r\n    @Bean\r\n    @Override\r\n    public UserDetailsService userDetailsServiceBean() throws Exception {\r\n        return super.userDetailsServiceBean();\r\n    }\r\n\r\n    @Bean\r\n    public AuthenticationProvider authenticationProvider() {\r\n        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();\r\n        authenticationProvider.setUserDetailsService(userDetailsService);\r\n        authenticationProvider.setPasswordEncoder(new ShaPasswordEncoder());\r\n\r\n        return authenticationProvider;\r\n    }\r\n\r\n    @Override\r\n    protected void configure(AuthenticationManagerBuilder auth) throws Exception {\r\n        auth.authenticationProvider(authenticationProvider());\r\n    }\r\n\r\n    @Override\r\n    protected AuthenticationManager authenticationManager() throws Exception {\r\n        return super.authenticationManager();\r\n    }\r\n\r\n    @Override\r\n    protected void configure(HttpSecurity http) throws Exception {\r\n        http.csrf().disable()\r\n                .authenticationProvider(authenticationProvider())\r\n                .exceptionHandling()\r\n                .authenticationEntryPoint(authenticationEntryPoint)\r\n                .and()\r\n                .formLogin()\r\n                .permitAll()\r\n                .loginProcessingUrl(LOGIN_PATH)\r\n                .usernameParameter(USERNAME)\r\n                .passwordParameter(PASSWORD)\r\n                .successHandler(authSuccessHandler)\r\n                .failureHandler(authFailureHandler)\r\n                .and()\r\n                .logout()\r\n                .permitAll()\r\n                .logoutRequestMatcher(new AntPathRequestMatcher(LOGIN_PATH, \"DELETE\"))\r\n                .logoutSuccessHandler(logoutSuccessHandler)\r\n                .and()\r\n                .sessionManagement()\r\n                .maximumSessions(1);\r\n\r\n        http.authorizeRequests().anyRequest().authenticated();\r\n    }\r\n}<\/pre>\n<p>This was a sneak peak at the overall configuration, I attached in this article a Github repository containing a sample project <a href=\"https:\/\/github.com\/imrabti\/gwtp-spring-security\" rel=\"nofollow\">https:\/\/github.com\/imrabti\/gwtp-spring-security<\/a>.<\/p>\n<p>I hope this will help some of you developers struggling to figure out a solution, please feel free to ask any questions, or post any enhancements that can make this solution better.<\/p>\n<div class=\"attribution\">\n<table>\n<tbody>\n<tr>\n<td><span class=\"reference\">Reference: <\/span><\/td>\n<td><a href=\"http:\/\/crazygui.wordpress.com\/2014\/08\/29\/secure-rest-services-using-spring-security\/\">Secure REST services using Spring Security<\/a> from our <a href=\"http:\/\/www.javacodegeeks.com\/jcg\">JCG partner<\/a> Idriss Mrabti at the <a href=\"http:\/\/crazygui.wordpress.com\/\">Fancy UI<\/a> blog.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Overview Recently, I was working on a project which uses a REST services layer to communicate with the client application (GWT application). So I have spent a lot of to time to figure out how to secure the REST services with Spring Security. This article describe the solution I found, and I have implemented. I &hellip;<\/p>\n","protected":false},"author":109,"featured_media":240,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[30,125],"class_list":["post-29571","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-java","tag-spring","tag-spring-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Secure REST services using Spring Security<\/title>\n<meta name=\"description\" content=\"Overview Recently, I was working on a project which uses a REST services layer to communicate with the client application (GWT application). So I have\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Secure REST services using Spring Security\" \/>\n<meta property=\"og:description\" content=\"Overview Recently, I was working on a project which uses a REST services layer to communicate with the client application (GWT application). So I have\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html\" \/>\n<meta property=\"og:site_name\" content=\"Java Code Geeks\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/javacodegeeks\" \/>\n<meta property=\"article:published_time\" content=\"2014-09-01T19:00:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"150\" \/>\n\t<meta property=\"og:image:height\" content=\"150\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Idriss Mrabti\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@javacodegeeks\" \/>\n<meta name=\"twitter:site\" content=\"@javacodegeeks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Idriss Mrabti\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html\"},\"author\":{\"name\":\"Idriss Mrabti\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/person\\\/e515a240800bca93c14ddb785393f338\"},\"headline\":\"Secure REST services using Spring Security\",\"datePublished\":\"2014-09-01T19:00:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html\"},\"wordCount\":612,\"commentCount\":2,\"publisher\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-logo.jpg\",\"keywords\":[\"Spring\",\"Spring Security\"],\"articleSection\":[\"Enterprise Java\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html\",\"name\":\"Secure REST services using Spring Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-logo.jpg\",\"datePublished\":\"2014-09-01T19:00:33+00:00\",\"description\":\"Overview Recently, I was working on a project which uses a REST services layer to communicate with the client application (GWT application). So I have\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html#primaryimage\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-logo.jpg\",\"contentUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-logo.jpg\",\"width\":150,\"height\":150,\"caption\":\"spring-interview-questions-answers\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2014\\\/09\\\/secure-rest-services-using-spring-security.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Java\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/category\\\/java\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Enterprise Java\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/category\\\/java\\\/enterprise-java\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Secure REST services using Spring Security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#website\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\",\"name\":\"Java Code Geeks\",\"description\":\"Java Developers Resource Center\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\"},\"alternateName\":\"JCG\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.javacodegeeks.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\",\"name\":\"Exelixis Media P.C.\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/exelixis-logo.png\",\"contentUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/exelixis-logo.png\",\"width\":864,\"height\":246,\"caption\":\"Exelixis Media P.C.\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/javacodegeeks\",\"https:\\\/\\\/x.com\\\/javacodegeeks\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/person\\\/e515a240800bca93c14ddb785393f338\",\"name\":\"Idriss Mrabti\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3dcfcaf05f6074a03b3464be4fb6ccb93418caff1c3161b9d53f2bbf597bc472?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3dcfcaf05f6074a03b3464be4fb6ccb93418caff1c3161b9d53f2bbf597bc472?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3dcfcaf05f6074a03b3464be4fb6ccb93418caff1c3161b9d53f2bbf597bc472?s=96&d=mm&r=g\",\"caption\":\"Idriss Mrabti\"},\"sameAs\":[\"http:\\\/\\\/crazygui.wordpress.com\\\/\"],\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/author\\\/Idriss-Mrabti\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Secure REST services using Spring Security","description":"Overview Recently, I was working on a project which uses a REST services layer to communicate with the client application (GWT application). So I have","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html","og_locale":"en_US","og_type":"article","og_title":"Secure REST services using Spring Security","og_description":"Overview Recently, I was working on a project which uses a REST services layer to communicate with the client application (GWT application). So I have","og_url":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html","og_site_name":"Java Code Geeks","article_publisher":"https:\/\/www.facebook.com\/javacodegeeks","article_published_time":"2014-09-01T19:00:33+00:00","og_image":[{"width":150,"height":150,"url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg","type":"image\/jpeg"}],"author":"Idriss Mrabti","twitter_card":"summary_large_image","twitter_creator":"@javacodegeeks","twitter_site":"@javacodegeeks","twitter_misc":{"Written by":"Idriss Mrabti","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html#article","isPartOf":{"@id":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html"},"author":{"name":"Idriss Mrabti","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/person\/e515a240800bca93c14ddb785393f338"},"headline":"Secure REST services using Spring Security","datePublished":"2014-09-01T19:00:33+00:00","mainEntityOfPage":{"@id":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html"},"wordCount":612,"commentCount":2,"publisher":{"@id":"https:\/\/www.javacodegeeks.com\/#organization"},"image":{"@id":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html#primaryimage"},"thumbnailUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg","keywords":["Spring","Spring Security"],"articleSection":["Enterprise Java"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html","url":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html","name":"Secure REST services using Spring Security","isPartOf":{"@id":"https:\/\/www.javacodegeeks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html#primaryimage"},"image":{"@id":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html#primaryimage"},"thumbnailUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg","datePublished":"2014-09-01T19:00:33+00:00","description":"Overview Recently, I was working on a project which uses a REST services layer to communicate with the client application (GWT application). So I have","breadcrumb":{"@id":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html#primaryimage","url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg","contentUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg","width":150,"height":150,"caption":"spring-interview-questions-answers"},{"@type":"BreadcrumbList","@id":"https:\/\/www.javacodegeeks.com\/2014\/09\/secure-rest-services-using-spring-security.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.javacodegeeks.com\/"},{"@type":"ListItem","position":2,"name":"Java","item":"https:\/\/www.javacodegeeks.com\/category\/java"},{"@type":"ListItem","position":3,"name":"Enterprise Java","item":"https:\/\/www.javacodegeeks.com\/category\/java\/enterprise-java"},{"@type":"ListItem","position":4,"name":"Secure REST services using Spring Security"}]},{"@type":"WebSite","@id":"https:\/\/www.javacodegeeks.com\/#website","url":"https:\/\/www.javacodegeeks.com\/","name":"Java Code Geeks","description":"Java Developers Resource Center","publisher":{"@id":"https:\/\/www.javacodegeeks.com\/#organization"},"alternateName":"JCG","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.javacodegeeks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.javacodegeeks.com\/#organization","name":"Exelixis Media P.C.","url":"https:\/\/www.javacodegeeks.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/06\/exelixis-logo.png","contentUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/06\/exelixis-logo.png","width":864,"height":246,"caption":"Exelixis Media P.C."},"image":{"@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/javacodegeeks","https:\/\/x.com\/javacodegeeks"]},{"@type":"Person","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/person\/e515a240800bca93c14ddb785393f338","name":"Idriss Mrabti","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/3dcfcaf05f6074a03b3464be4fb6ccb93418caff1c3161b9d53f2bbf597bc472?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/3dcfcaf05f6074a03b3464be4fb6ccb93418caff1c3161b9d53f2bbf597bc472?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3dcfcaf05f6074a03b3464be4fb6ccb93418caff1c3161b9d53f2bbf597bc472?s=96&d=mm&r=g","caption":"Idriss Mrabti"},"sameAs":["http:\/\/crazygui.wordpress.com\/"],"url":"https:\/\/www.javacodegeeks.com\/author\/Idriss-Mrabti"}]}},"_links":{"self":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts\/29571","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/users\/109"}],"replies":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/comments?post=29571"}],"version-history":[{"count":0,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts\/29571\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/media\/240"}],"wp:attachment":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/media?parent=29571"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/categories?post=29571"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/tags?post=29571"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}