Secure JAX-RS
summary
Shows JAX-RS services using JWT in Authorization header for stateless authentication and embedded authorization claims, plus HTTP Signature draft headers to ensure message integrity across microservices. Demo builds a small webshop where filters/interceptors attach and verify tokens and signatures; SSL alone is insufficient because intermediaries and browser storage expose payloads. Shows signature verification with public keys, token expiry and header-size limits, and notes localStorage/JS crypto tradeoffs; the solution works in demo but requires careful key handling and client-side secrecy.
AI-written summary · about
chapters (13)
- 0:00Secure JAX-RS introduction
- 3:57REST security limits
- 7:58SSL client-server limits
- 9:49Vulnerable webshop demo
- 12:45Secure tokens for auth
- 17:46JWT tokens in practice
- 20:17JWT header inspection
- 22:11SSL transport vs app
- 24:17JWT signatures and tamper
- 26:43JWT header pitfalls
- 28:33XSS browser risks
- 29:14Beyond authentication security
- 30:18Q&A
related talks
47mDeconstructing and Evolving REST Security
32mREST security essentials
38mAuthentication as a Microservice: Portable Customer Identity Management
24mA Token Walks Into a SPA
32mPortable Sessions with JSON Web Tokens
34mWhat makes JSON Web Tokens (JWT) secure?
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
19mJWT! What is it good for? Absolutely everything!