Implementing REST Token-Based Authentication with JAX-RS and Jersey

Fundamentals of Token-Based Authentication

Token-based authentication mechanisms transform hard credentials (such as username and password) into token data, enabling stateless identity verification. Clients include tokens in subsequent requests instead of original credentials, while servers authenticate and authorize by validating token validity.

JAX-RS 2.0 Authentication Endpoint Implementation

Create authentication resource endpoints to handle user login requests, verify credentials, and generate/return tokens:

@Path("/authentication")
public class AuthenticationEndpoint {
    
    @POST
    @Produces(MediaType.APPLICATION_JSON)
    @Consumes(MediaType.APPLICATION_JSON)
    public Response authenticateUser(Credentials credentials) {
        try {
            authenticate(credentials.getUsername(), credentials.getPassword());
            String token = issueToken(credentials.getUsername());
            return Response.ok(new TokenResponse(token)).build();
        } catch (AuthenticationException e) {
            return Response.status(Response.Status.UNAUTHORIZED).build();
        }
    }
    
    private void authenticate(String username, String password) {
        // Implement database or LDAP authentication logic
    }
    
    private String issueToken(String username) {
        // Generate random string or JWT token
    }
}

Authentication Filter Design and Implementation

Intercept requests through custom ContainerRequestFilter, extracting and validating Bearer tokens from Authorization headers:

@Secured
@Provider
@Priority(Priorities.AUTHENTICATION)
public class AuthenticationFilter implements ContainerRequestFilter {
    
    private static final String AUTH_SCHEME = "Bearer";
    
    @Override
    public void filter(ContainerRequestContext context) {
        String authHeader = context.getHeaderString(HttpHeaders.AUTHORIZATION);
        
        if (!isValidAuthHeader(authHeader)) {
            abortWithUnauthorized(context);
            return;
        }
        
        String token = extractToken(authHeader);
        try {
            validateToken(token);
            setSecurityContext(context, extractUsernameFromToken(token));
        } catch (InvalidTokenException e) {
            abortWithUnauthorized(context);
        }
    }
    
    private void setSecurityContext(ContainerRequestContext context, String username) {
        context.setSecurityContext(new SecurityContext() {
            @Override
            public Principal getUserPrincipal() {
                return () -> username;
            }
            
            @Override
            public boolean isUserInRole(String role) {
                return hasRole(username, role);
            }
            
            @Override
            public boolean isSecure() {
                return context.getSecurityContext().isSecure();
            }
            
            @Override
            public String getAuthenticationScheme() {
                return AUTH_SCHEME;
            }
        });
    }
}

Name Binding and Endpoint Protection

Define @Secured annotation to bind filters to protected resource methods:

@NameBinding
@Retention(RUNTIME)
@Target({TYPE, METHOD})
public @interface Secured { }

Apply security annotations in resource classes:

@Path("/api")
public class ApiResource {
    
    @GET
    @Path("public")
    public Response publicEndpoint() {
        // Public endpoint requiring no authentication
    }
    
    @GET
    @Secured
    @Path("secure")
    public Response secureEndpoint(@Context SecurityContext securityContext) {
        Principal user = securityContext.getUserPrincipal();
        // Secure endpoint requiring valid token
    }
}

Token Generation Strategies

Provide two main token generation approaches: random strings and JWT standard tokens.

Random String Tokens

Generate high-entropy random strings as opaque tokens:

public String generateRandomToken() {
    SecureRandom random = new SecureRandom();
    byte[] bytes = new byte[32];
    random.nextBytes(bytes);
    return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
}

JWT Token Implementation

Utilize self-contained JWT standards including claims and digital signatures:

public String generateJWTToken(String username, List<String> roles) {
    return Jwts.builder()
        .setSubject(username)
        .claim("roles", roles)
        .setIssuedAt(new Date())
        .setExpiration(new Date(System.currentTimeMillis() + 3600000))
        .signWith(SignatureAlgorithm.HS256, secretKey)
        .compact();
}

Security Context and User Identification

Retrieve current user information in resource methods by overriding request security context:

@GET
@Secured
@Path("profile")
public Response getUserProfile(@Context SecurityContext securityContext) {
    String username = securityContext.getUserPrincipal().getName();
    UserProfile profile = userService.findProfileByUsername(username);
    return Response.ok(profile).build();
}

CDI Integration Approach

As an alternative to SecurityContext, use CDI event mechanisms to propagate authenticated user information:

@Qualifier
@Retention(RUNTIME)
@Target({METHOD, FIELD, PARAMETER})
public @interface AuthenticatedUser { }

@RequestScoped
public class UserProducer {
    
    @Produces
    @RequestScoped
    @AuthenticatedUser
    private User currentUser;
    
    public void handleUserEvent(@Observes @AuthenticatedUser String username) {
        this.currentUser = userRepository.findByUsername(username);
    }
}

Performance Optimization and Security Considerations

For database query optimization, implement token caching mechanisms to reduce repeated validation overhead. All authentication communications must use HTTPS to prevent man-in-the-middle attacks. For JWT tokens, implement revocation mechanisms through token blacklists or short-lived tokens with refresh token strategies.

System Design Practices

When building large-scale distributed systems, token authentication mechanisms require deep integration with system architecture. Through systematic design exercises, optimize token storage strategies, design highly available authentication services, and implement unified identity management across services to ensure system scalability and security.