REST API (Web API) Part 2 - Security

This post is part 2 in the series of REST API's using spring and spring boot. If you have not yet read part 1, then please do so in order to follow along the steps in this tutorial. However if you only wish to obtain the information about API Security and have no interest in building a rest service yourself using JAVA then feel free to read along.

In order to secure a REST API or anything else for that matter, we need to have a formal understanding of what security is within this context. This tutorial will focus on security centered around Authentication and Authorization as this is what we are going to center our implementation around.

Authentication

Authentication is the act of proving the identity of who we are. So when someone is trying to access our REST API, we want to ensure that the caller can be identified and thereby only allow trusted users to access the service. The most basic way of authentication is by using a User/password approach which works if we trust that the password is kept secure. However there are other ways of Authentication and these can be combined in what is called Two Factor Authentication. Two Factor Authentication is acomblished by using two or more techniques to authenticate. See example of such techniques below:

• Something you know (e.g A user account containing a username and Password)
• Something you have (e.g A mobile phone where a SMS can be send with a unique code)
• Somerthing you are (Biometics e.g fingerprint or eye scanner)

If you're further interrested in Authentication, the following video from the Vinsloev Academy YouTube channel is recommended:

Authorization

Authorization is the step following that a given user has Authenticated successfully. Authorization is the process of giving someone permission to do or access something. So if we have a Web Application there might be a set of Services which regular users can access and a set of admin services that only a admin is supposed to use. The users in the system is thereby divided into groups which will be given different authorization rights even though both groups can authenticate to the same Web Application.

Securing our REST API

Now that the differences between Authentication and Authorization has been established it's time to look further into how we can achieve such for our Java REST API. In this guide we will make use of the Spring Security Framework which is the de-facto standard for securing Spring-based applications. For more about Spring Security, see: https://spring.io/projects/spring-security. If you have followed the steps in Part 1 of this tutorial you can implement this without much effort. All you need to do to add this Framework to your project is to add the following to your POM.xml file. within the dependencies tag.

In this part of the tutorial we will stick to basic Authentication with the use of a single User account. To add such you will go to the resources packed and then add the following in the application.properties file.

in the user.name you can specify a username whereas in the user.password you will write the password. When adding this you will see the following login page, next time you try to access your REST API.

In Part 3 we will take a closer look at how to add multiple users and implement Authorization mechanisms as the single user we have created now have access to all resources.