Securing your mobile API - Spring Security

Basic webapp registration and authentication

1. In the registerAuthentication() method, as well as the normal setting of UserServices and password encryptor, I am also adding a Remember Me Authentication provider
2. In the configure() method on the formLogin component we are also setting a RemeberMeService
3. We are setting @Order annotation on the class with value 2

API security configuration

1. First of all, we define @Order with value 1 - as you have probably guessed, this defines the order in which the security config is loaded/considered - we want the API security to kick in first
2. In our configure() method, we first specify an ant matcher so the rules in this config only apply to URLs that start /api/
3. We state that all requests to this pattern must be authenticated and apply a RememberMeAuthenticationFilter to run before the Basic authentication chain runs
4. We also set the session management to be stateless - this refers to serverside sessions, as we don't want to retain server session state
5. We then configure the Remember Me beans - this is all standard and as per the Spring guidelines here.  The only difference is that we have a custom TokenBasedRememberMeService - that we will look at later.

Security flow

1. Request comes in - we check if it matches /api/**
2. If it does match, then all requests must be authenticated - and run the RememberMeAuthenticationFilter 
3. The filter simply uses the RememberMeService and AuthenticationProvider to check the token/cookie value to see if it can pre-authenticate the request.
4. If it has matched the URL but doesn't authenticate on the filter, then it will 403
5. If the URL does not match /api/** then the request starts the second security config
6. If the url matches the resources, sign-up, sign-in then allow the request to complete, otherwise require authentication, so (default spring behaviour) direct all other requests to the registered login page ("/")

Customising remember me

Caveats

• This is fairly basic security - requests should be made over https to prevent man-in-the-middle attacks, alternatively look at a solution like Amazon use whereby the token isn't passed, rather it is used to hash the request body which is then checked on the server side (prevent the need for sending the user token every request)
• This is currently open to anyone to use/build against - there aren't any checks for app key/secret etc - so you would probably want to build that in to prevent other parties building apps against the api and getting a user token in the same way.
• I'm not a security expert - this is just my interpretation of the Google guidelines using Spring Securities RememberMe classes. This is really just a thought experiment, getting up to speed with how Spring Security works in more details and experimenting with mobile app fun. Use at your own risk..

Securing your API for mobile access

• I am experimenting building an Android mobile app that will use a server API (webapp & API will be built using Java & Spring stack)
• The app I am experimenting is mobile-only (no web client)
• It is not going to become a public API (e.g. won't be supporting other apps/sites)

• Build an webapp on your server that has a login page 
• From your mobile app, embed a WebView of the login page
• Upon login to your app, return a cookie with a token value that can be used to log in your user on future requests - ideally re-using your frameworks Remember-Me type services so not to have to hand-roll your own
• On every API request include the token in your request header to authenticate (again using the Remember Me services)

Everything is Technology

Maybe?

• Amazon - completely changed the face of retail and is almost single handedly making high streets around the uk obsolete
• iTunes et al - once again, changed the face of the music industry, record shops etc
• AirBnB - changing the way that people think about travel and disrupting the hotel/holiday accommodation industry.

"Today, the world's largest bookseller, Amazon, is a software company—its core capability is its amazing software engine for selling virtually everything online, no retail stores necessary. On top of that, while Borders was thrashing in the throes of impending bankruptcy, Amazon rearranged its web site to promote its Kindle digital books over physical books for the first time. Now even the books themselves are software."

EVERYONE, LEARN TO CODE. NOW!

The Wikis don't work

Thing is though, they kinda suck.

Someone should build one.

Boss MVC - A Lightweight Coldfusion MVC Framework

• Annotation or config defined mapping for URL > Controller methods
• Simple returns from controllers - just returning view name and model data (to remove the temptation of building HTML code in controllers - a clearer separation of controller and view
• clearly & appropriately scoped variables in the views (everything to local, as under the hood, everything is being rendered from a CFC, so if you don't local scope the view then you may get surprises)

Controllers:

/**
 * @Controller
 **/
component output = "false"  {

    /**
     * @RequestMapping
     **/
    public Array function default( Struct resourceParams="" ){
        return [ "homepage" ];
    }
}

/**
 * @Controller /user
 **/
component output = "false"  {

    /**
     * @RequestMapping /:username
     **/
    public Array function default( Struct resourceParams="" ){
        return [ "userpage" ];
    }
}

Views:

[
    {
        "name": "homepage",
        "template": "home.pagetemplate",
        "include": {
            "header": "home.header",
            "body": "home.body",
            "footer": "home.footer"
        }
    },
    {
        "name": "userpage",
        "template": "user.pagetemplate",
        "include": {
            "header": "user.header",
            "body": "user.body",
            "footer": "user.footer"
        }
    }
]

<html lang="en">
    <cfoutput>#local.header#</cfoutput>
    <body>
        <cfoutput>#local.body#</cfoutput>
        <cfoutput>#local.footer#</cfoutput>
    </body>
</html>

/**
 * @Controller
 **/
component output = "false"  {

    /**
     * @RequestMapping
     **/
    public Array function default( Struct resourceParams="" ){
        return [ "homepage" ];
    }
}

Models:

/**
 * @Controller /user
 **/
component output = "false"  {

    /**
     * @RequestMapping /:username
     **/
    public Array function default( Struct resourceParams="" ){
        return [ "userpage", { greeting: "Yo!"} ];
    }
}

<h1><cfoutput>#local.model.greeting#</cfoutput> <cfoutput>#local.model.username#</cfoutput>!</h1>

Flat Design (& Android)

Flat Android Design

Fonts

Buttons

Colours