在 Java 中保护 REST API [英] Securing a REST API in Java

问题描述

我正在 Java 中构建 REST API - 使用 Jersey.我想使用 API 令牌安全方案来保护敏感的 API 调用，但我不知道从哪里开始.

I am building a REST API in Java - using Jersey. I want to secure sensitive API calls with an API token security scheme, but I don't have any idea where to start.

是否有一个框架可以立即为我执行此操作?还是我必须实施自己的安全方案?

Is there a framework that will do this for me out of the box? Or do I have to implement my own security scheme?

推荐答案

有几个框架可以实现安全的 Java RESTful Web 服务.我会推荐Apache Shiro"(http://shiro.apache.org/)，它是一个非常好用且易于使用的安全框架，它将允许您实现您提到的 API 令牌安全方案.看看这个回复:REST API 密钥生成策略(其中我对创建这样的解决方案给出了一些见解).

There are several frameworks to do secure Java RESTful web services. I would recommend "Apache Shiro" (http://shiro.apache.org/), it is a very nice and easy to use security framework that will allow you to implement the API token security scheme you mention. Take a look at this response: REST API key generation strategy (where I gave some insights on creating such a solution).

您可以使用其他安全框架，即 Java EE 支持安全性，Spring 也提供安全性支持.看看 Matt Raible 的这个非常好的演讲，他在那里展示并演示了这三个框架:http://www.slideshare.net/mraible/java-web-application-security-denver-jug-2013

There are other security frameworks you can use, namely Java EE has support for security and also Spring provides support for security. Take a look at this very nice presentation by Matt Raible where he presents and demos these three frameworks: http://www.slideshare.net/mraible/java-web-application-security-denver-jug-2013

避免实施您自己的安全方案"(如果您不是该主题的专家...)，有许多问题可能会被忽视并导致问题...通常这些框架有助于避免

Avoid to implement "your own security scheme" (if you are not an expert in the topic...), there are many issues that may be overlooked and lead to problems... normally these frameworks help a lot on avoiding that.

HTH.

这篇关于在 Java 中保护 REST API的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！