I am working on a project, and I came here in this moment, where I now need authorization. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly think basic username:password auth will hold. And, the documentation of Shiro doesn't say much about tokens. Therefore, as the alternative, I am thinking to implement token.

I came upon few ideas.

1.To use Oauth, but it sounds too complicated.

2.To use JWT. This sounds fascinating.

So, after some research, and based upon ease of use, I opted to use JWT. But, I came across some questions.

  1. While reading online, I saw Authorization header decorated with "Bearer ". What does Bearer do? As far as I have understood, "Bearer has something to do with Oauth, as googling Bearer mostly comes with "Oauth" on it.
  2. However, I decided to put this header to the response, "Authorization" : "Bearer ".
  3. Now what, how will jax-rs figure out itself. Do I need to implement my own methods to deal with authorization, or there are some filters or frameworks that deals with all these so I can focus on what I can do.
  • Sorry but product recommendations are prohibited on this site. You should probably ask that part on another site? – Neil Smithline Oct 27 '15 at 0:02

Bearer means that possessing the token (ie: being the bearer of the token) is sufficient to be authorized. You don't need to prove you hold a private key or something else.

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.