java - Using Cookie for Authentication with Restful service in Spring -

i've used spring security secure restful web services built spring, in past request has used authentication headers authentication. need secure application when user's credentials in cookie.

i'm trying figure out best way either extract user's information cookie , put authentication header, or ideally use value of cookie loaduserbyusername method in userdetailsservice bean.

so far i've come few ideas how this:

1. i add handlerinterceptor use cookie add authentication headers requests. however, not requests require authentication, if did want apply methods or request mappings , not others, , don't know how that.

2. i implement authenticationentrypoint show in this tutorial. in tutorial though don't understand why has response.senderror( httpservletresponse.sc_unauthorized, "unauthorized" ); body of commence method. in use case, adding authentication header using cookie there?

3. i perform security checks using custom method in first line of controller methods. seems when follow spring security's ideal path, it's pretty solution. need seems straying that, though, , requirements quite simple. maybe i'd better off doing easy old-fashioned way?

4. some better idea don't know / haven't thought of!

i appreciate , thoughts!

if got requirements correctly, might easiest use spring security's pre-authentication framework classes implement desired auth mechanism.

in general, these classes designed support scenarios, authentication mechanism provided external system ensures http requests contain kind of authentication information can used webapp. in case auth info seems in cookie can used identify user.

assuming have userdetailsservice implementation users name, implement requirements:

1) create subclass of abstractpreauthenticatedprocessingfilter implementing abstract method getpreauthenticatedprincipal(httpservletrequest) extract principal (user name) cookie. there abstract method (getpreauthenticatedcredentials()) may return null, if there no credentials in request. logic implemented in abstract superclass creates auth token containing extracted principal, , submits auth manager.

2) create bean of type preauthenticatedauthenticationprovider receive auth token auth manager, in order populate (load user's roles). class needs injected variant of userdetailsservice takes whole auth token instead of user name. can use userdetailsbynameservicewrapper adapt original userdetailsservice interface:

<bean id="preauthauthprovider" class="org.springframework.security.web.authentication.preauth.preauthenticatedauthenticationprovider">     <property name="preauthenticateduserdetailsservice">         <bean id="userdetailsservicewrapper" class="org.springframework.security.core.userdetails.userdetailsbynameservicewrapper">             <property name="userdetailsservice" ref="youruserdetailsservice"/>         </bean>     </property> </bean> 

3) wire things using configuration similar what's shown in the documentation:

<security:http>     ...     <security:custom-filter position="pre_auth_filter" ref="preauthfilter" /> </security:http>  <bean id="preauthfilter" class="com.whatever.yourpreauthfilter"/>  <security:authentication-manager>     <security:authentication-provider ref="preauthauthprovider" /> </security:authentication-manager> 

so, needed implement requirements subclass 1 single method, , additional configuration wire existing supporting classes.