We Keep Coding

How to frame URL with username and password to access Rest API using basic authentication Java?

I have developed Rest API basic authentication, I am able to get the JSON response only when I test using Advanced Rest Client plugin(for Chrome), But how to access the JSON response by passing username and password in URL? How can others consume my rest API? Do I need to give any login popup? How can I achieve this? Any help would be highly appreciated.

your method should be POST and you need to create a encripted token for every login, and you need to active that token up to user logged out or anything else, you can store that token in browser cache, when user logged out then remove that token as well. for every user action you need to verify that token. you can generate token using MD5 also.
i think it may help you.

Access User of Proxy in HttpServletRequest

I need to acess the name of the user of the Proxy, our server is Jboss6.4, when this user enter in my URL, I'm using ServletRequestListener, with the object HttpServletRequest, but I can't find the user.
String user1= request.getUserPrincipal().getName();
String user2 = request.getRemoteUser();
Both's are null, I need to do authentication without use a typical modal window or formular, I want to do this automatic, my idea it's use the LogonId of the User that he use in the Proxyof the browser and afterwards check in my LDAP directory if exist and the rights are correct.
To acess to the URL, the user first has to login in the browser because we have a proxy, my idea is take the id of the user from the proxy, but Ican't find it..

Unless your proxy is setting a header containing the username in the forwarded HTTP requests, you won't have the ability to retrieve the username used to connect to the proxy.
What you want to achieve looks like SSO but a simple proxy won't achieve SSO.

Token based authentication for REST service: where to store generated token on server-side?

I'm trying to implement token authentication for a REST service based on Spring MVC.
I'm followiong this SO answer: https://stackoverflow.com/a/10864088/1061499 as guideline, but now I need to understand some server-side detail.
When an user is successfully authenticated (first time via username + password) I return a token that stores some information.
When the same user sent his token in a request header, I need to identify the associated user and define if is "session" is still alive.
So the way are basically two:
encrypt the token with an algorithm (which one?) I can also use to decrypt on server side and extract user information
store token-user association info in application DB also storing session info.
Most suggest the first solution, without storing any info about authentication in DB, but this solution seems to me less secure.
Any suggestion?

Get venue details without auth (Foursquare)

According to Foursquare's dev site, venue details do not require user auth:
HTTP Method GET
Requires Acting User No (learn more)
Modes supported foursquare, swarm (learn more)
But the example uses a oauth token and if you try searching with your client credentials, you get a 400 response.
https://api.foursquare.com/v2/venues/4b522afaf964a5200b6d27e3?client_id=MY_CLIENT_ID&client_secret=MY_CLIENT_SECRET&v=20140714
returns:
{"meta":{"code":400,"errorType":"invalid_auth","errorDetail":"Missing access credentials. See https:\/\/developer.foursquare.com\/docs\/oauth.html for details."},"response":{}}
Does anybody know of a way to get venue details without having user logged in?

Sigh
The issue was with my code. I was putting my client ID in twice.
just so everybody knows, the above works :)

Authentification using a user id stored in the session - security risk / bad practice?

I am developing a small REST-webservice for non critical data which will mainly be accessed by a smartphone application. For limiting the access of the users to their individual data (the authorization does not need groups or roles), I need to implement some sort of basic authentification.
As the service will be accessed over HTTP, using HTTP-Authentification seems to be no good idea as the username and password will be sent in cleartext on every request and need to be stored on the client device.
Thus, my idea was to implement authentification the following way:
The user logs on using a login method of my webservice passing their username / password
This method checks the validity of the username / password combination (based on a database containing salted and hashed passwords)
If the login is successful, the id of the user (primary key of the database table) is stored in the session as an attribute
In the following requests, this attribute is used to authentificate the user
In code, my login method would look like the following:
User user = this.authentificate(username, password);
HttpSession session = request.getSession(true);
if (user != null)
session.setAttribute("UserId", user.getId());
else
session.invalidate();
Afterwards, I would be able to authentificate the user based on the session:
int userId = (int) request.getSession().getAttribute("UserId");
User currentUser = getUserById(userId);
Can this approach be considered as "secure" (no easy session highjacking possible - as far as I understood https://stackoverflow.com/a/5838191/232175 , the attributes' values won't leave the server)?
Are there any downsides or alternatives?

With regard to storing the user id in the session, I think that is OK, but you have another problem.
First, I would assume that the login method would be over HTTPS, otherwise the username and password would be sent in clear text to the login method and you are right back to the same problem you had before.
Second, if the login method were over HTTPS, then the session cookie would be an HTTPS cookie and all other API calls would also need to be over HTTPS. If subsequent calls were over HTTP, they would get a new session cookie and the user id would be unavailable in that session.
If you really want secure authentication without HTTPS, you would need to use a shared secret signing scheme (e.g. HMAC) or an asymmetric signing system like RSA to have the client sign requests and then validate those signed requests server side.