CODEWITHSUNDEEP
springspring-mvcspring-restcontrollersiteminder
jinal
jinal

Reputation: 81

Securing spring mvc REST api using siteminder

I have written REST web service in java using spring MVC. As this service is stateless, how I can secure it using siteminder? For login authentication, we are using siteminder at frontend.

Upvotes: 3

Views: 634

Answers (1)

Richard Sand
Richard Sand

Reputation: 674

You can protect the web services URLs with CA SSO (aka SiteMinder) the same way you protect the user-facing parts of your website. Just create realms/rules/policies for the URLs. But there are some caveats/tricks:

  1. Include the SM session cookie in the client request
  2. Remember if the cookie is flagged HttpOnly, it won't work
  3. Use BASIC authentication for the realms - this way, your clients will receive a 401 if they aren't authenticated/authorized
  4. Also be wary of CORS restrictions if your web services aren't on the same hostname as the main page(s) of your app

HTH!

Upvotes: 2

Related Questions