I am working on a project, and I came here in this moment, where I now need authorization. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly think basic username:password auth will hold. And, the documentation of Shiro doesn't say much about tokens. Therefore, as the alternative, I am thinking to implement token.
I came upon few ideas.
1.To use Oauth, but it sounds too complicated.
2.To use JWT. This sounds fascinating.
So, after some research, and based upon ease of use, I opted to use JWT. But, I came across some questions.
- While reading online, I saw Authorization header decorated with "Bearer ". What does Bearer do? As far as I have understood, "Bearer has something to do with Oauth, as googling Bearer mostly comes with "Oauth" on it.
- However, I decided to put this header to the response, "Authorization" : "Bearer ".
- Now what, how will jax-rs figure out itself. Do I need to implement my own methods to deal with authorization, or there are some filters or frameworks that deals with all these so I can focus on what I can do.