title: Jersey REST sign xml
body: <p>I implemented my REST services using jersey. The communication layer is secured with ssl.
  On the client-side i got the requirement that i should sign the xml before i call the services and verify the request on the server-side.
  <a href="http://docs.oracle.com/javase/6/docs/technotes/guides/security/xmldsig/XMLDigitalSignature.html" rel="nofollow">http://docs.oracle.com/javase/6/docs/technotes/guides/security/xmldsig/XMLDigitalSignature.html</a></p>
  
  <p>My service at the moment:</p>
  
  <pre><code>@POST
  @Path(CONFIRM_PATH)
  @Produces({ MediaType.APPLICATION_XML })
  public ConfirmResponse confirm(ConfirmRequest request){
     // verify the signed confirm request
  }
  </code></pre>
  
  <p>Client-side code (spared out to cache the service instance for readability:</p>
  
  <pre><code>ClientConfig config = new DefaultClientConfig();
  Client client = Client.create(config);
  client.setConnectTimeout(CLIENT_CONNECT_TIMEOUT);
  client.setReadTimeout(CLIENT_READ_TIMEOUT);
  
  URI uri = UriBuilder.fromUri(url).build();
  WebResource service = client.resource(uri);
  // sign should happen here
  ConfirmResponse  response = service.post(ConfirmRequest.class, confirmRequest);
  </code></pre>
  
  <p>What is the best way to handle this?
  I could simply change the type to String to get the full xml, verify it and using jaxb afterwards to get the object.
  On the client-side i could also create the xml manually and post a string. </p>
  
  <p>This solution sounds very disappointing to me. Any ideas?</p>
  
  <p>best regards,
  m</p>