java - How to authorize user in page request if logged in with REST API? -
before, had asked question access control page rest service
but maybe need ask more briefly , more idea.
i have rest api. client browser. "login" 1 of rest service, user enters credentials , authenticated. then, user begins navigate different pages.
please note not ask rest api security, authentication/authorization etc.
the question is:
how check if user authenticated before, through rest api, see if user has right view particular web page? (web server based on java)
thank idea.
edit:
i see question understood how authorize rest api.
after authentication via rest api, i'm not asking other requests rest api. want see authentication in web server, @ domain, isolated rest server. imagine work-arounds; hear design alternatives. isn't there has separated web server , rest api? totally wrong?
authentication whether user can login application.
authorization whether user has rights view particular page.
i assume asking authorization after authentication.
while handling login post request, can create session id(encypted , time-bound) , set response headers, , whenever user sends request, should part of request headers, , in server side can check session request header authorize user.
Comments
Post a Comment