Question

I want to add user authentication to my restful api that I have created using the Java based Play! framework.

I currently have the Web based (browser accessed) app secured using the ‘secure module’ Details here: http://www.playframework.org/documentation/1.1/secure

Can I use the same module for authentication for when the restful apis are called directly via http requests?

If not, I would appreciate some pointers to tutorials/module for integrating another auth method (hopefully one that can apply to both web app access from browser and also http api access).

PS It would be nice to avoid doing HTTPS and digest if possible.

Answer 1

If you are already using a username/password mechanism adding http basic authentication for your API calls should not be difficult. You can create an interceptor that does something like:

public class ApiInterceptor extends Controller 
{
    @Before
    static void checkAccess() {
         if ( request.user == null || request.password == null) {
             unauthorized();
         }

         boolean canAccess = .... ;// check user and password here 
         if ( !canAccess ) {
             unauthorized();
         }
    }
 }

But this means that you need to use SSL since the username and password go in clear text over http.