title: RESTful webservice + Spring token authentication
body: <p>I am not too familiar with Spring but I have read some articles and how-tos.</p>
  
  <p>The business required are:</p>
  
  <ul>
  <li>typical client-server architecture: mobile clients and RESTful services on server side</li>
  <li>clients have different choices for log into the mobile application: application login and facebook login</li>
  <li>have to protect all RESTful services on server side against unauthorized users</li>
  </ul>
  
  <p>My responsibility is to develop RESTful services. I am very good at Application Servers, Java EE, JMS, JDBC, distributed transactions (XA) but I am not too good at security :(</p>
  
  <p>I developed with Spring some STATELESS RESTful webservices. These services are not protected, so everybody can use them.</p>
  
  <p>For example:</p>
  
  <ul>
  <li><code>http://...../api/country/{**user_id**}</code></li>
  <li><code>http://...../api/country/{**user_id**},{country_id}</code></li>
  <li>...</li>
  </ul>
  
  <p>Each of my webservices has a <strong>user_id</strong> input parameter because I need to identify which user made the server call. The result of webservices depend on the user. Of course, it is absolutely normal.</p>
  
  <p>Now, I have to develop some new things because I have to protect these webservices against unauthorized users.</p>
  
  <p><strong>My idea is:</strong></p>
  
  <p>(*) I will create two new webservice like this:</p>
  
  <p><em>applicationLogin(String username, String password)[/INDENT]</em>
       and
  <em>facebookLogin(String accessToken)</em></p>
  
  <ul>
  <li><code>http://...../api/login/{username}, {password}</code></li>
  <li><code>http://...../api/login/{facebook access token}</code></li>
  </ul>
  
  <p>(*) I will have to protect my webservices against unauthorized users</p>
  
  <p><em>The user logging process may look like this:</em>
  (1) user fill up the username and password fields on the his/her mobile device
  (2) click on the application login button
  (3) the mobile application makes a server call to <code>http://...../api/login/{username}, {password}</code> public service
  (4) if username and password is correct I will generate a token (a long string with expiration date information) and I will put the username and the token string into the answer of HTTP header
  (5) after it the all client have to send back to the server these two parameters (username and token) when they make webservice call. </p>
  
  <p>On the server side I can read the username from the HTTP request so I can remove the <strong>user_id</strong> parameter from the signature of all webservices.</p>
  
  <p>I am trying to implement this process in Spring. I think I need to use the <strong>PRE_AUTH_FILTER</strong> from Spring security module. But I do not know if my idea is good?</p>
  
  <p><strong>I did it:</strong></p>
  
  <p>web xml</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/api/country/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;/WEB-INF/applicationContext-security.xml, /WEB-INF/applicationContext.xml&lt;/param-value&gt;
  &lt;/context-param&gt;
  </code></pre>
  
  <p>applicationContext-security.xml</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xmlns:p="http://www.springframework.org/schema/p"
              xmlns:security="http://www.springframework.org/schema/security"
  
         xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
         http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
      &lt;security:http use-expressions="true" create-session="stateless" auto-config="false" entry-point-ref="authenticationEntryPoint"&gt;
          &lt;security:intercept-url pattern="/api/login/*" access="permitAll"/&gt;
          &lt;security:intercept-url pattern="/api/country/*" access="isAuthenticated()" /&gt;
          &lt;security:custom-filter position="PRE_AUTH_FILTER" ref="authenticationTokenProcessingFilter" /&gt;
      &lt;/security:http&gt;
  
      &lt;bean id="authenticationEntryPoint" class="com.samples.spring.auth.ForbiddenAuthenticationEntryPoint" /&gt;
  
      &lt;bean id="userDetailsServiceImpl" class="com.samples.spring.auth.UserDetailsServiceImpl" /&gt;
  
      &lt;bean id="preAuthenticationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"&gt;
  
          &lt;property name="preAuthenticatedUserDetailsService" ref="userDetailsServiceImpl" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="authenticationTokenProcessingFilter" class="com.samples.spring.auth.AuthenticationFilter"&gt;
  
          &lt;property name="authenticationManager" ref="appControlAuthenticationManager" /&gt;
      &lt;/bean&gt;
  
      &lt;security:authentication-manager alias="appControlAuthenticationManager"&gt;
          &lt;security:authentication-provider ref="preAuthenticationProvider" /&gt;
      &lt;/security:authentication-manager&gt;      
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>What do you think, about my login process? Is it a good way to start to implement the token handling method?</p>