How to use HTTP Basic Authentication to secure services

HTTP Basic authentication is a popular topic in the SCWCD/OCWCD (Oracle Certified Web Component Developer exam).  It can be used to secure web services too.
While i was reading some blog posts during the vacation i came across an interesting post related to securing web services using HTTP Basic Auth and invoking the secured service with a web service client.

Here is the link to the post : http://blog.facilelogin.com/2008/11/secure-your-service-with-http-basic.html

HTTP methods

Normally you don't care about HTTP methods except GET and POST. But there are other HTTP 1.1 methods besides GET and POST.

GET - Asks to get the resource at the requested URL

POST - Asks the server to accept the body info attached to the request, and give it to the thingat the requested URL. (It's like a GET with extra info sent with the request)

HEAD Asks only the header part of whatever a GET would return. (Gives you info about the requested URL without actually getting back the thing).

TRACE  Asks for a loopback of the requested message (Used for testing and troubleshooting)

PUT Says to put the enclosed info (the body) at the requested URL

DELETE Says to delete the thing

OPTIONS Asks for a list of the HTTP methods o which the thing at the requested URL can respond

CONNECT Says to connect for the purpose of tunneling

(Head First - SCWCD study guide)

Java Servlet Specification 3.0 - Quick Overview

What is a servlet?
A servlet is a JavaTM technology-based Web component, managed by a container,
that generates dynamic content. Like other Java technology-based components,
servlets are platform-independent Java classes that are compiled to platform-neutral
byte code that can be loaded dynamically into and run by a Java technology-enabled
Web server.

Java servlet technology is a widely accepted technology for creating dynamic java web applications. It is behind all modern java web frameworks. Following can be considered as the main focus of this release.

1. Ease of development using Java annotations, 
2. Asynchronous Servlet support 
3. Pluggability and extendability of using fragments
4. Security enhancements.

Annotations support has made the development easy. According to [1] it allows you to write a Servlet without requiring a descriptor. The web.xml may be user to override metadata specified via annotations.
@WebServlet and @WebFilter are the two main annotations for configuring the servlets and filters in Servlet 3.0. More details available at [1] and [2].

Asynchronous support (processing) is the biggest change made in the specification. According to [1] . it is introduced as a solution to following cases

1. Waiting for a resource to become available, such as JDBC or a call to a Web Service.
2. Generating response asynchronously
3. Using exisiting frameworks to generate responses after waiting the for asychronous operation to complete.

assyncSupported attribute is used with @WebServlet and @WebFilter.

If this attribute is set to the true then the servlet or servlet filter spports the asynchronous processing and if this attribute is not used or is set to false then the servlet or servlet filter will not support the asynchronous process.


<web-fragment> is introduced in the servlet 3.0 specification and it has the ability to reduce the configuration

The following presentation will provide a great understanding about the new features of servlet 3.0 specification.

Servlets 3.0 - Asynchronous, Extensibility, Ease-of-use @ JavaOne Brazil 2010

View more presentations from Arun Gupta

[1] http://java.dzone.com/articles/an-overview-servlet-30
[2] http://tejakantamneni.wordpress.com/2010/08/09/java-servlet-specification-3-0-overview-and-quick-intro/#comment-75