3

I've read almost every answer on SO and some blog postings, but I can't figure out one simple thing. In a simple token authentication scheme where the server generates a token and sends it back to the user after verifying credentials, how does the client store and then resend that token in each request? I have seen both cookie examples and header examples. I would like to use the HTTP Headers if possible, but I can't figure out the mechanics of how to send the token to the client, where it will sit, and then have it sent back in the header upon requesting a REST resource.

I am using Jersey/Guice with AngularJS on the front end. Here are the resources I started with:

http://porterhead.blogspot.co.uk/2013/01/writing-rest-services-in-java-part-6.html

Session management : How to generate Authentication token for REST service ? (Jersey)

Community
  • 1
  • 1
oberger
  • 1,217
  • 2
  • 16
  • 31

2 Answers2

1

It depends on your needs. You can use HTTP basic or digest auth, if it is appropriate for you. If not, then if you don't need a permanent storage, you can store credentials in memory. If you need a permanent storage, then you can store them in localstorage, or any other client side storage, but aware, that they are considered not secure.

Anyways I think if your client or service is compromised somehow with xss, then you lost, and it does not matter what else you do about it. Otherwise you can send the credentials in plain text securely as long as you use HTTPS with proper settings. (But that's just an opinion, I am not a security expert, at least not in this topic.) So I think you should concentrate on not being xss vulnerable. For example you should use the proper headers and filter the input against js injection (and by firefox data URI injection). And use TextNode in your client instead of innerHTML wherever it is possible.

Community
  • 1
  • 1
inf3rno
  • 24,976
  • 11
  • 115
  • 197
0

For example if you are using Javascript you can store the token in localstorage like window.localStorage["token_id"] on the client side.

tnash
  • 385
  • 4
  • 12
  • Would you then write the token manually into the header for each request? (or use some sort of AngularJS interceptor?) – oberger May 27 '14 at 21:39
  • yes I would send the token in the header with each request that way you check if it hasn't expired when you try to do the request – tnash May 27 '14 at 21:41