Authentication from a REST service

Question

I am in the process of setting up a web service between an android app and Tomcat 6.0.26 implemented with Jersey. I already have client and server communicating with each other by sending XML requests. But I would like the user of the client to be authenticated by the server for a set period of time and then have to re-authenticate after that time has expired.

Please suggest?

Answer 1

If you are using Servlet 3.0, you can use HttpServletRequest.login to authenticate the user using a realm configured for the context. If you use FORM authentication, then the session's expiration time becomes the duration of the login (a caveat being that the timeout is reset for every request the client makes).

If you want fixed-login times (like 30-minutes max regardless of how many requests are made), then stuff your own expiration date into the user's session and then check that timeout with each request. This could all be done in a Filter to keep things orthogonal to your servlet code.