title: Securing REST API in JBoss
body: <p>I'm developing a RESTeasy <strong>JSON</strong> API under <strong>JBoss-As 7</strong>.</p>
  
  <p>I have another separate web-server.</p>
  
  <p>I am developing with <strong>JAVA</strong> on server-side, and on client-side with <strong>Javacript</strong>, <strong>JQuery</strong>, <strong>AJAX</strong>.</p>
  
  <p>So, I have 2 <strong>distinct</strong> *<em>war</em>*s, let say they can be accessed as following:</p>
  
  <ul>
  <li>https.//localhost:8443/services</li>
  <li>http.//localhost:8080/web</li>
  </ul>
  
  <p>Now I want to <strong>secure</strong> these two guys; <strong>RESTeasy API</strong> and <strong>web-server</strong>.</p>
  
  <p>Let me tell about my structure:</p>
  
  <ul>
  <li>I keep the users in <strong>DB</strong> with username-password. These are the only users for now.</li>
  <li>I have a login page to authenticate my users (I don't want http basic auth popup and any workaround about that)</li>
  <li>The clients of <strong>REST API</strong> are browsers (not web server). The static page is load, and then some other dynamic things are load through REST API, calling within from browser using <strong>JQuery</strong>, AJAX, whatever.</li>
  <li>All communication can be through <strong>SSL/TLS</strong>, no problem.</li>
  <li>For the future, scalability (clients other than web-browsers, ability to authenticate with social network logins, etc.) should be in mind.</li>
  </ul>
  
  <p>My scenario is as following:</p>
  
  <ul>
  <li>Client is browser.</li>
  <li>Client wants to access a web page <code>web/aaa.html</code> which is restricted to authenticated users.</li>
  <li>Client is redirected to login page: <code>web/login.html</code></li>
  <li><p>Client filled the <strong>FORM</strong> and sent to ... either,</p>
  
  <p><strong>a)</strong> to the rest-api, or</p>
  
  <p><strong>b)</strong> to web-server,</p>
  
  <p>not sure (So, here you have an implicit question).</p>
  
  <p>But in any case, what a or b should do is the same:</p>
  
  <p>Check username-password. Let say they are checked and the user is authenticated.</p></li>
  <li><p>From now on, I should have got these two things at the same time:</p>
  
  <p><strong>1-</strong> Client is authorized to navigate the restricted pages.</p>
  
  <p><strong>2-</strong> Client will be authorized on REST API calls.</p></li>
  </ul>
  
  <p>So, I need these 2 things at the same time happen, after authenticating in login page.</p>
  
  <p>I have read lots of things, about authorization in REST API, with tokens, keys, etc. and yes I also have heard about <strong>Spring Security</strong>, <strong>Apache Shiro</strong>, etc.</p>
  
  <p>And yes, I do not want to implement a new security framework by own and I will use one. I imagine that some framework can produce/check tokens etc. for me.</p>
  
  <p>Before Spring Security and Apache Shiro, I want to know about <strong>resteasy skeleton key JBoss module</strong>. </p>
  
  <p>There are these sources:</p>
  
  <p><a href="https://github.com/resteasy/Resteasy/tree/3.0.1.Final/jaxrs/examples/oauth2-as7-example" rel="nofollow">https://github.com/resteasy/Resteasy/tree/3.0.1.Final/jaxrs/examples/oauth2-as7-example</a></p>
  
  <p><a href="http://docs.jboss.org/resteasy/docs/3.0-beta-2/userguide/html/oauth2.html" rel="nofollow">http://docs.jboss.org/resteasy/docs/3.0-beta-2/userguide/html/oauth2.html</a></p>
  
  <p>But, they didn't seem to me very explicative, and also I am not sure if they are what I need.</p>
  
  <p>Is there someone who knows how to configure skeleton key (or in general JBoss App layer) and give me useful example to achieve what I've described, please?</p>
  
  <p>Or, could you give me some other advice/example to achieve my goal, especially noting that my question is about "<strong>how to implement</strong>"? I don't see where to begin.</p>
  
  <p>Thanks in advance.</p>