Edit Question - KnowledgeHub

Title Body

Let /users/{id} be a resource url in RESTful service. Basic authentication is enabled and only authenticated users are allowed to access the url. Example Scenario: User_1 & User_2 are authenticated users with userId 1 & 2. Since both are authenticated, both of them are having access to, /users/1 /users/2 But the expectation is User_1 should have access to /users/1 and not to /users/2 or other userId. Question: How to do resource level authorization in RESTful services? Note: I am implementing RESTful using Jax-RS (with Apache CXF implementation), helpful if you could explain with Jax-RS. -Barath Edit: As Donal mentioned, I am not looking for role based authorization rather resource level authorization. To give an example, lets say /users/{id}/photos/{photoId} be another resource url. User_1 should be given access to the photos belong to him only. If photoId of 2 belonging to user_2, then we should give http_404 error code for user_1 when a request /users/1/photos/2 is requested.[Since User_1 is also authenticated user he can invoke /users/ 2 /photos/2, so we must identify the user id based on authentication parameters than via resource url] Only solution I can think of is, include the unique id which determines the authorization in each query like, Instead of SELECT * FROM PHOTO_TBL WHERE PHOTO_ID=2; use SELECT * FROM PHOTO_TBL, USER_TBL WHERE PHOTO_ID=2 AND USER_ID=1 AND USER_ID=PHOTO_ID; with this resources are delivering data that belongs to specific user. [There should be a mechanism to prevent the modification of the unique id in client side which is used to decide on authorization(userId in this case), since all requests are STATELESS request] Caveat

Tags (comma-separated) Cancel