JAX-RS and HTTPOnly flag in Cookies

JAX-RS in Java

JAX-RS is an important technology/standard/specification in the JavaEE family. Version 1.1 is included in Java EE 6. JAX-RS enables Java applications to become REST enabled.

Currently JAX-RS v2.0 specification work is under development in the JCP.

HttpOnly Flag

HttpOnly flag in cookies sent from the server have an important behavior on the client side (browser based applications). Javascript applications cannot access the cookies marked with HttpOnly flag.

This is a non-standard flag in the cookie standard.  But all the major browser implementations support this. So it is important for all Java server runtimes and frameworks that deal with cookies to support HttpOnly.

JavaEE6 has support for HttpOnly via the Servlet3 specification as well as support for configuration in the web.xml cookie-config xml element.

JAX-RS 2.0 has been updated to incorporate HttpOnly flag in the NewCookie class (http://lists.jboss.org/pipermail/security-dev/2013-February/000783.html) Thanks to Bill Burke. [ Bill Burke created a JIRA issue with the spec: http://java.net/projects/jax-rs-spec/lists/issues/archive/2013-02/message/0 )]

HttpOnly in JAX-RS

For Jax-RS 1.1 (included in Java EE 6), you will need to do something like the following:

=============
NewCookie cookie = new NewCookie(...);
Response response = Response.ok().header("Set-Cookie", cookie.toString()+ ";HttpOnly").build();
=============

Example: https://github.com/picketlink/picketlink-extensions/blob/master/core/src/main/java/org/picketlink/extensions/core/rest/interceptors/PostSignInCookieInterceptor.java

RESTEasy project has ServerResponse that extends JAX-RS Response class.  This class is very important for pre and post processing interceptors.

References

1. RESTEasy
2. JAX-RS discussion on HttpOnly
3. PicketLink discussion on RESTEasy/HttpOnly

GMail can be key to your digital life

Matt Honan (Wired) has this heart wrenching story of his digital life being erased. The door to this tragedy was his gmail account.
http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/

You have heard this story from many channels (twitter, facebook, email forwards etc). So I won't repeat it.

But I do recommend enabling two factor authentication on your gmail account.  It is additional inconvenience that is necessary to safeguard your gmail account and potentially your intertwined digital life.

If you have a smartphone such as iphone or android, do not forget to review the section on Google Authenticator.


Perform the following steps:
1) Log into your gmail account.
2) Go to settings via
https://support.google.com/accounts/bin/answer.py?hl=en&answer=180744&topic=1056283&rd=1
3) Now start the two step process by giving a phone number (such as mobile).
4) Get the code via sms or voice.  Activate your account.
5) Two step authentication is enabled for your gmail account.  You may want to set "trust the computer" you are using.

Now for each additional device such as iphone or android or ipad you use to get email addresses, you can generate application specific passwords.
https://accounts.google.com/IssuedAuthSubTokens#accesscodes

This is one time setup for each device.  Hopefully, you should change this quarterly.

Google Authenticator (Smartphone Users)

Instead of using a call from Google each time you login from an unknown location or device, you can use the "Google Authenticator" mobile app available in the iphone app store and Android Market.

1) Download "Google Authenticator" from your app store.
2) Log into gmail account.
3) https://accounts.google.com/b/0/SmsAuthConfig
4) Start the Authenticator App.
5) Press the + button.  Then press the "Scan the barcode" button.
6) Scan the barcode on the computer using your phone.
7) Once the barcode is scanned, you will get a code displayed on the app.
8) Enter the code into the computer screen in the text box.
9) Click Verify.

PicketLink and Salesforce/Google Apps Integration

Marek Posolda from the GateIn team has created an excellent article on integrating salesforce or google apps with JBoss.  It is done via project PicketLink.

The article is at https://docs.jboss.org/author/display/PLINK/3rd+party+integration

Marek also talks about GateIn integration with Salesforce and Google Apps using PicketLink at https://community.jboss.org/wiki/GateInSSOIntegrationWithSalesforceAndGoogleApps

References

GateIn SAML Integration Wiki