1

I have read many discussions about authentication, authorization etc. with REST services. I have now idea how to make authentication/authorization with REST.

But the thing I did not get is, how to control access to a web page with REST service. Is it a good practice? If so, how?

Example:

  • root of REST services: localhost/services

  • root of web pages: localhost/pages

Now, the scenario is:

1. Client tries to go to the page localhost/pages/join.html but, it does not have right to access.

2. Thus, server should check if the client has right to access to the page, and since it does not have right, should redirect the client to somewhere.

My question is not how the server would check, understand if the client has right or not.

However, I want to know, when and how I could make this check and redirection with REST service.

For example, the first idea that comes to my mind is, in the body of join.html, with <body onload> run a javascript that checks the access right of the client sending a JSON message to REST service, let say, to localhost/services/access.

Then, service will return its answer, and if it is OK, the page will be loaded, if not, it will be redirected with window.location.href. Is this the way to decide the right of access to a web page with REST service? Is there other common solution / practice?

Please again note that I am not asking, how to secure my REST API etc., but

How do I check access rights to my web pages with REST service?

4

2 回答 2

2

您可以将从 REST API 接收到的令牌发送到 Web 服务器，以使其保存在浏览器客户端的会话对象中。

于 2013-06-30T14:27:16.847 回答
2

我认为最好在服务器端进行授权和验证，客户端不安全，因为您的代码和逻辑完全暴露，很容易伪造请求。

一般来说，在服务器端，你可以使用拦截器来拦截请求，在拦截器中，检查用户角色和他的访问权限，然后决定是重定向请求（或发送403响应）还是发送正常资源。

拦截器的实现取决于您在服务器端使用的语言。

例如，如果您使用 java(jax-rs)：http ://docs.oracle.com/cd/E24329_01/web.1211/e24983/secure.htm#autoId0

如果您使用 servlet，请构建一个过滤器。

如果使用struts2，直接支持interceptor。并且使用 Spring 开发的应用程序，您可以使用 AOP 来拦截请求。

如果您将 node.js 与 express 一起使用，您可以构建一个处理身份验证逻辑的中间件。

希望这些会有所帮助:)

更新：

请求流程是：获取请求 -> 获取客户端令牌（一般是 cookie） -> 根据该令牌找到用户角色 -> 检查角色是否允许访问资源 -> 服务资源

于 2013-05-12T00:08:52.127 回答