RESTful Java Web Services Security

Description

In Detail This book will serve as a practical companion for you to learn about common vulnerabilities when using RESTful services, and will provide you with an indispensable knowledge of the tools you can use to implement and test security on your applications. It will cover the fine details of setting up RESTful services such as implementing RESTEasy and securing transmission protocols such as the OAuth protocol and its integration with RESTEasy. Furthermore, it also explains the implementation of digital signatures and the integration of the Doseta framework with RESTEasy. With this book, you will be able to design your own security implementation or use a protocol to grant permissions over your RESTful applications with OAuth. You will also gain knowledge about the working of other features such as configuring and verifying HTTP and HTTPS protocols, certificates, and securing protocols for data transmission. By the end of this book, you will have comprehensive knowledge that will help you to detect and solve vulnerabilities. Approach A sequential and easy-to-follow guide which allows you to understand the concepts related to securing web apps/services quickly and efficiently, since each topic is explained and described with the help of an example and in a step-by-step manner, helping you to easily implement the examples in your own projects. Who this book is for This book is intended for web application developers who use RESTful web services to power their websites. Prior knowledge of RESTful is not mandatory, but would be advisable.;Cover; Copyright; Credits; About the Authors; About the Reviewers; www.PacktPub.com; Table of Contents; Preface; Chapter 1: Setting Up the Environment; Downloading tools; Downloading links; Creating the base project; First functional example; Testing the example web service; Summary; Chapter 2: The Importance of Securing Web Services; The importance of security; Security management options; Authorization and authentication; Authentication; Authorization; Access control; Transport layer security; Basic authentication by providing user credentials; Digest access authentication. Cover Copyright Credits About the Authors About the Reviewers www.PacktPub.com Table of Contents Preface Chapter 1: Setting Up the Environment Downloading tools Downloading links Creating the base project First functional example Testing the example web service Summary Chapter 2: The Importance of Securing Web Services The importance of security Security management options Authorization and authentication Authentication Authorization Access control Transport layer security Basic authentication by providing user credentials Digest access authentication. An example with explanationAuthentication through certificates API keys Summary Chapter 3: Security Management with RESTEasy Fine-grained and coarse-grained security Securing HTTP methods HTTP method -- POST HTTP method -- GET Fine-grained security implementation through annotations The @RolesAllowed annotation The @DenyAll annotation The @PermitAll annotation Programmatical implementation of fine-grained security Summary Chapter 4: RESTEasy Skeleton Key OAuth protocol OAuth and RESTEasy Skeleton Key What is RESTEasy Skeleton Key? OAuth 2.0 authentication framework. Main featuresOAuth2 implementation Updating RESTEasy modules in JBoss Setting up the configuration in JBoss Implementing an OAuth client SSO configuration for security management OAuth token via Basic Auth Running the application Custom filters Server-side filters Client-side filters Example usage of filters Summary Chapter 5: Digital Signatures and Encryption of Messages Digital signatures Updating RESTEasy JAR files Applying digital signatures Testing the functionality Validating signatures with annotations Message body encryption Testing the functionality. Enabling the server with HTTPSTesting the functionality Summary Index.