title: Basic authentication in REST-application
body: <h3>Environment:</h3>
  <ul>
  <li>JAVA</li>
  <li>Glassfish</li>
  <li>REST-services in different machine</li>
  <li>HTML5-client with
  AJAX and JQuery</li>
  <li>Jersey</li>
  </ul>
  <p>This is what I have implemented so far:</p>
  <h3>HTML5-client</h3>
  <pre><code>$('#btnSignIn').click(function () {
      var username = $(&quot;#username&quot;).val();
      var password = $(&quot;#password&quot;).val();
  
      function make_base_auth(user, password) {
          var tok = user + ':' + password;
  
          var final = &quot;Basic &quot; + $.base64.encode(tok);
          console.log(&quot;FINAL----&gt;&quot; + final);
          alert(&quot;FINAL----&gt;&quot; + final);
  
          return final;
      }
  
      $.ajax({
          type: &quot;GET&quot;,
          contentType: &quot;application/json&quot;,
          url: &quot;http://localhost:8080/SesameService/webresources/users/secured/login&quot;,
          crossDomain: true,
          dataType: &quot;text&quot;,
          async: false,
          data: {},
          beforeSend: function (xhr) {
              xhr.setRequestHeader('authorization', make_base_auth(username, password));
          },
          success: function () {
              alert('Thanks for your signin in! ');
  
          },
          error: function (jqXHR, textStatus, errorThrown) {
              console.log(textStatus, errorThrown);
              alert(' Error in signIn-process!! ' + textStatus);
          }
      });
  });
  </code></pre>
  <h3>SERVER</h3>
  <p>In Security, I haven't got Security Manager enabled, it is disabled!</p>
  <p>I have configured BASIC-authentication to Glassfish and my web.xml looks like that:</p>
  <pre class="lang-xml prettyprint-override"><code>&lt;servlet-mapping&gt;
      &lt;servlet-name&gt;ServletAdaptor&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/webresources/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;REST Protected resources&lt;/web-resource-name&gt;
          &lt;description/&gt;
          &lt;url-pattern&gt;/users/*&lt;/url-pattern&gt;
          
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;admin&lt;/role-name&gt;
          &lt;role-name&gt;customer&lt;/role-name&gt;
          &lt;role-name&gt;user&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  
  
  
  &lt;login-config&gt;
          &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
          &lt;realm-name&gt;jdbcRealm&lt;/realm-name&gt;
      &lt;/login-config&gt;
      &lt;security-role&gt;
          &lt;role-name&gt;admin&lt;/role-name&gt;
      &lt;/security-role&gt;
      &lt;security-role&gt;
          &lt;role-name&gt;user&lt;/role-name&gt;
      &lt;/security-role&gt;
      &lt;security-role&gt;
          &lt;description/&gt;
          &lt;role-name&gt;customer&lt;/role-name&gt;
      &lt;/security-role&gt;
  </code></pre>
  <h3>GLASSFISH</h3>
  <p><img src="https://i.stack.imgur.com/fmaLi.png" alt="enter image description here" /></p>
  <h3>LOG</h3>
  <pre><code>FINE: [Web-Security] Setting Policy Context ID: old = null ctxID = SesameService/SesameService
  FINE: [Web-Security] hasUserDataPermission perm: (&quot;javax.security.jacc.WebUserDataPermission&quot; &quot;/webresources/users/secured/login&quot; &quot;GET&quot;)
  FINE: [Web-Security] hasUserDataPermission isGranted: true
  FINE: [Web-Security] Policy Context ID was: SesameService/SesameService
  FINE: [Web-Security] hasResource isGranted: true
  FINE: [Web-Security] hasResource perm: (&quot;javax.security.jacc.WebResourcePermission&quot; &quot;/webresources/users/secured/login&quot; &quot;GET&quot;)
  </code></pre>
  <h3>QUESTION:</h3>
  <ol>
  <li><p>If I encrypt (NOT encode) password in client when user is signing up and transfer it under the SSL/HTTPS, is this secure and good way to implement this?</p>
  </li>
  <li><p>If I use REST-service without client, it is always open, WHY? No BASIC-authentication? Have I understood something wrong with those url-patterns?</p>
  <pre><code> http://localhost:8080/SesameService/webresources/users/secured/login
  </code></pre>
  </li>
  <li><p>IF I get this working how to test that, because now if I authenticate once, I am authorised always? Is it possible to &quot;log out&quot; programatically inside the REST-service or in generally how to implement Log out?</p>
  </li>
  <li><p>When using Authorization in header with mandatory base64-encoded username:password do I have to encode my username and password to DB as well? I tried that and added Encoding (allowed values are Hex and Base64) to jdbcRealm to Glassfish and it seems that password is enough, but what happens when both are encoded in client?</p>
  </li>
  </ol>
  <p><strong>UPDATE:</strong> I changed web.xml and now BASIC-authentication is working when calling REST-service straight in browser :<code>http://localhost:8080/SesameService/users/secured/login</code></p>
  <p>Changes:</p>
  <ul>
  <li>I enabled security manager in Glassfish</li>
  <li>I changed url-pattern</li>
  </ul>
  <pre><code>    &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;ServletAdaptor&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;----&gt; I took webresources off. It was generated by Netbeans
      &lt;/servlet-mapping&gt;
  </code></pre>
  <ul>
  <li>I changed the url to service to this: <code>http://localhost:8080/SesameService/users/secured/login</code></li>
  </ul>
  <p>Now I get a HTTP/1.1 401 Unauthorized when trying to authenticate from HTML5-client.</p>
  <p><strong>Request headers:</strong></p>
  <pre><code>Origin: http://localhost:8383
  Host:localhost:8080
  Connection:keep-alive
  Access-Control-Request-Method:GET
  Access-Control-Request-Headers:authorization,content-type
  </code></pre>
  <p><strong>Response:</strong></p>
  <pre><code>x-powered-by:Servlet/3.0 JSP/2.2 (GlassFish Server Open Source Edition 3.1.2.2 Java/Oracle Corporation/1.7)
  WWW-Authenticate:Basic realm=&quot;jdbcRealm&quot;
  Server:GlassFish Server Open Source Edition 3.1.2.2
  Pragma:No-cache
  Expires:Thu, 01 Jan 1970 02:00:00 EET
  Date:Sat, 13 Apr 2013 15:25:06 GMT
  Content-Type:text/html
  Content-Length:1073
  Cache-Control:no-cache
  </code></pre>
  <p><strong>UPDATE 2</strong></p>
  <p>When I try to authenticate with JavaScript + Authorization-header I got 401 error and that in the log:</p>
  <pre><code>FINE: [Web-Security] Setting Policy Context ID: old = null ctxID = SesameService/SesameService
  FINE: [Web-Security] hasUserDataPermission perm: (&quot;javax.security.jacc.WebUserDataPermission&quot; &quot;/users/secured/login&quot; &quot;OPTIONS&quot;)
  FINE: [Web-Security] hasUserDataPermission isGranted: true----&gt;!!!!!!!!!!!!!
  FINE: [Web-Security] Policy Context ID was: SesameService/SesameService
  FINE: [Web-Security] Codesource with Web URL: file:/SesameService/SesameService
  FINE: [Web-Security] Checking Web Permission with Principals : null-------&gt;!!!!!!!
  FINE: [Web-Security] Web Permission = (&quot;javax.security.jacc.WebResourcePermission&quot; &quot;/users/secured/login&quot; &quot;OPTIONS&quot;)
  FINEST: JACC Policy Provider: PolicyWrapper.implies, context (SesameService/SesameService)- result was(false) permission ((&quot;javax.security.jacc.WebResourcePermission&quot; &quot;/users/secured/login&quot; &quot;OPTIONS&quot;))
  FINE: [Web-Security] hasResource isGranted: false-------&gt;!!!!!!!!!
  FINE: [Web-Security] hasResource perm: (&quot;javax.security.jacc.WebResourcePermission&quot; &quot;/users/secured/login&quot; &quot;OPTIONS&quot;)
  FINEST: JACC Policy Provider: PolicyWrapper.getPermissions(cs), context (null) codesource ((null &lt;no signer certificates&gt;)) permissions: java.security.Permissions@5d4de3b0 (
  </code></pre>
  <p><strong><strong>UPDATE 3</strong></strong>
  I can't be the first and only person who is trying to authenticate using BASIC in cross domain case.
  I changed my cross origin filters like that:</p>
  <pre><code>response.getHttpHeaders().putSingle(&quot;Access-Control-Allow-Headers&quot;, &quot;Authorization&quot;);
  </code></pre>
  <p>NO 401 error anymore but still error in JavaScript. IN Glassfish log:</p>
  <pre><code>FINEST: JACC Policy Provider:
  getPolicy (SesameService/SesameService) is NOT in service-----&gt;!!!!!!!!
  FINE: JACC Policy Provider: file arrival check type: granted  arrived: false exists: false lastModified: 0 storedTime: 1365968416000 state: deleted SesameService/SesameService
  FINE: JACC Policy Provider: file arrival check type: excluded  arrived: false exists: false lastModified: 0 storedTime: 0 state: deleted SesameService/SesameService
  FINE: TM: getTransaction: tx=null, tm=null
  FINE: TM: componentDestroyedorg.apache.catalina.servlets.DefaultServlet@227fe9a8
  FINE: TM: resourceTable before: 0
  FINE: TM: resourceTable after: 0
  </code></pre>
  <p>BTW, because I have never get this work, does this work same way than calling the REST-service direct in its own domain. So, First client requests, server requests and username-password window opens, then client request and server authenticate and response the page? I am trying to get it: Request with Authorization header in it, response from server with result from the rest service and that's it. Any idea how to secure REST-services? Easier than that? This is impossible.</p>
  <p><strong>UPDATE 4</strong></p>
  <p>I just tried to move my HTML5-client to under java web-project, just pure html-pages and under same domain and BASIC-authentication is working 100 %. So the reason is because of cross-domain environment.</p>