83a0f7275c
Replaced the ApiKey concept with ephemeral tokens. Users and apps obtain a token by authenticating the user credentials (to be implemented). The service then generates a temporary token that is stored by the client and sent with every request using the `Authorization-Token` header. The server verifies this token to recognize and authenticate the request. With an authenticated user, the server can use the user's role to authorize requests. This implementation uses JSR 250 SecurityContext and security annotations.
38 lines
1.5 KiB
XML
38 lines
1.5 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!-- This web.xml file is not required when using Servlet 3.0 container,
|
|
see implementation details http://jersey.java.net/nonav/documentation/latest/jax-rs.html -->
|
|
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5">
|
|
<context-param>
|
|
<param-name>context.config.file</param-name>
|
|
<param-value>/newlifesongs.properties</param-value>
|
|
</context-param>
|
|
|
|
<listener>
|
|
<listener-class>com.jdbernard.nlsongs.servlet.NLSongsContextListener</listener-class>
|
|
</listener>
|
|
|
|
<servlet>
|
|
|
|
<servlet-name>New Life Songs REST API</servlet-name>
|
|
<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
|
|
|
|
<init-param>
|
|
<param-name>jersey.config.server.provider.packages</param-name>
|
|
<param-value>com.jdbernard.nlsongs.rest</param-value>
|
|
</init-param>
|
|
|
|
<init-param>
|
|
<param-name>jersey.config.server.provider.classnames</param-name>
|
|
<param-value>org.glassfish.jersey.server.filter.RolesAllowedDynamicFeature</param-value>
|
|
</init-param>
|
|
|
|
<load-on-startup>1</load-on-startup>
|
|
</servlet>
|
|
|
|
<servlet-mapping>
|
|
<servlet-name>New Life Songs REST API</servlet-name>
|
|
<url-pattern>/api/*</url-pattern>
|
|
</servlet-mapping>
|
|
|
|
</web-app>
|