title: Token-based authentication in Java EE 6
body: <p>I want to implement a token-based authentication mechanism for a scenario which is similar to the following:</p>
  
  <p>In Google Calendar, you can invite guests to your event, who in turn can respond to these events right from the email invitation. The invitation to such an event contains the respective links to respond (Yes, No, Maybe) with authentication tokens encoded in the URL. These authentication tokens are restricted to the specific event and user.</p>
  
  <p>What's the best practice to generate these kinds of "one-time" tokens that can only perform limited actions and have only access to limited resources (and potentially are only valid for a limited amount of time)? And how do I implement this in Glassfish? I want to expose this through the RESTful API of my application (using Jersey). Currently, all URL paths in my app are secured with an authentication constraint, which I configured in the web.xml. </p>
  
  <p>My approach to this would be as follows:</p>
  
  <ol>
  <li>Provide a URL where no authentication constraint is applied (e.g. /token_auth) and use this for token authentication. </li>
  <li>In the web service method, manually check the security tokens and do the required actions. The tokens are saved in the DB along with information such as username, expiration date, authorized resources, etc.</li>
  </ol>
  
  <p>I was wondering whether there is a more elegant solution using any frameworks or built-in container capabilities that can avoid all the manual work. And whether this solution might have some security drawbacks.</p>
  
  <p>A similar question has been asked on SO before: <a href="https://stackoverflow.com/questions/5252940/">Newbie at JAAS authentication; Sign in using a token in the URL Bar</a></p>