Package org.apache.juneau.rest.server.auth

Class BearerTokenGuard

java.lang.Object
org.apache.juneau.rest.server.guard.RestGuard
org.apache.juneau.rest.server.auth.BearerTokenGuard
public class BearerTokenGuard extends RestGuard
AuthN RestGuard that authenticates requests via the RFC 6750 Bearer Token scheme.

On every request, the guard:

  1. Reads the Authorization request header.
  2. Confirms it starts with "Bearer " (case-insensitive) followed by a non-blank token.
  3. Delegates the raw token to the configured TokenValidator.
  4. On success, stashes the returned Principal on the request attributes under "juneau.principal" so downstream handlers can read it via @Auth Principal or req.getAttributes().get(PRINCIPAL_ATTR).
  5. On any failure path (missing header, malformed scheme, validator throws), throws AuthenticationException with a WWW-Authenticate: Bearer realm="<realm>" response header set per RFC 7235 §4.1.
Usage

@Rest(path="/api") public class ApiResource extends RestServlet { @Bean(name="guards") public RestGuardList guards(BeanStore bs) { return RestGuardList.create(bs) .append( BearerTokenGuard.create() .realm("api") .validator(myTokenValidator) .build()) .build(); } }

Security notes
  • Bearer tokens are credentials — never log the full token, never echo it in a response body, and always pair with TLS in production.
  • TokenValidators should run in constant time when possible (in particular, opaque-token lookups should use constant-time comparison to defeat timing side-channels).
  • For JWT verification, use the JwtTokenValidator shipped in the optional juneau-rest-server-auth-jwt sub-module — it enforces algorithm allowlisting and mandatory iss / aud / exp / nbf checks by default.
See Also:
Since:
10.0.0

  • Constructor Details

    • BearerTokenGuard

      protected BearerTokenGuard(BearerTokenGuard.Builder builder)
      Constructor.
      Parameters:
      builder - The builder to read configuration from. Must not be null.

    • BearerTokenGuard

      public BearerTokenGuard(TokenValidator validator)
      Convenience constructor that uses the default realm ("api").
      Parameters:
      validator - The token validator. Must not be null.

  • Method Details

    • create

      public static BearerTokenGuard.Builder create()
      Static creator.
      Returns:
      A new builder.

    • guard

      public boolean guard(RestRequest req, RestResponse res)
      Description copied from class: RestGuard
      Checks the current HTTP request and throws a BasicHttpException if the guard does not permit the request.

      By default, throws an SC_FORBIDDEN exception if RestGuard.isRequestAllowed(RestRequest) returns false.

      Subclasses are free to override this method to tailor the behavior of how to handle unauthorized requests.

      Overrides:
      guard in class RestGuard
      Parameters:
      req - The servlet request.
      res - The servlet response.
      Returns:
      true if request can proceed. Specify false if you're doing something like a redirection to a login page.

    • isRequestAllowed

      public boolean isRequestAllowed(RestRequest req)
      Description copied from class: RestGuard
      Returns true if the specified request can pass through this guard.
      Specified by:
      isRequestAllowed in class RestGuard
      Parameters:
      req - The servlet request.
      Returns:
      true if the specified request can pass through this guard.