[osee-dev] OSEE Security

["Brooks, Ryan D" <ryan.d.brooks@xxxxxxxxxx>]

I think we can simplify the OSEE security model if we require all incoming requests to come through the REST API.  This means that we could use a single security protocol that would be applied to all REST calls.  (This would in no way limit server-side to server-side calls to using the REST API).  One change this would require is to the server-side console interface (however this could be safely done later).

 

I found the following link to be a helpful guide to securing a REST API:   http://www.stormpath.com/blog/secure-your-rest-api-right-way

 

This link provides some specifics about using OAuth Core 1.0 Revision A:  https://wikis.oracle.com/display/Jersey/OAuth

 

Thanks,

Ryan