I'm developing Backend Service using JAX-RS and JWT for authentication. But with JWT, when user login on new devices, new JWT token will be generated and previous JWT token for this user will be invalid. So how can I use session or something like that to remember login of user on all devices which they have ?
Here is my code for login and check authentication :
@POST
@Path("/authenticate")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
public Response authenticateCredentials(@HeaderParam("email") String email,
@HeaderParam("password") String password, @HeaderParam("accessToken") String accessToken,
@HeaderParam("type") String loginType)
throws JsonGenerationException, JsonMappingException, IOException {
logger.info("Authenticating User Credentials...loginType : " + loginType);
StatusMessage<Users> statusMessage = null;
String jweSerialization = null;
if(loginType == null){
statusMessage = new StatusMessage();
statusMessage.setStatus(Status.PRECONDITION_FAILED.getStatusCode());
statusMessage.setMessage("login type value is missing...");
return Response.status(Status.PRECONDITION_FAILED.getStatusCode()).entity(statusMessage).build();
}
LoginType type = LoginType.valueOf(loginType);
switch (type) {
case systems:
if(email == null){
statusMessage = new StatusMessage();
statusMessage.setStatus(Status.PRECONDITION_FAILED.getStatusCode());
statusMessage.setMessage("email value is missing...");
return Response.status(Status.PRECONDITION_FAILED.getStatusCode()).entity(statusMessage).build();
}
if(password == null){
statusMessage = new StatusMessage();
statusMessage.setStatus(Status.PRECONDITION_FAILED.getStatusCode());
statusMessage.setMessage("password value is missing...");
return Response.status(Status.PRECONDITION_FAILED.getStatusCode()).entity(statusMessage).build();
}
Users user = usersDAO.validate(email, password);
logger.info("user after validate : " + user);
if(user == null){
statusMessage = new StatusMessage();
statusMessage.setStatus(Status.NOT_FOUND.getStatusCode());
statusMessage.setMessage("User not found...");
return Response.status(Status.NOT_FOUND.getStatusCode()).entity(statusMessage).build();
}
jweSerialization = getJWEToken(user);
user.setPassword(null); //not return password and OTP
user.setOTP(null);
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.OK.getStatusCode());
statusMessage.setMessage(jweSerialization);
statusMessage.setData(user);
logger.info("statusMessage : " + statusMessage);
return Response.status(Status.OK.getStatusCode()).entity(statusMessage).build();
case facebook:
if(email == null){
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.PRECONDITION_FAILED.getStatusCode());
statusMessage.setMessage("email value is missing...");
return Response.status(Status.PRECONDITION_FAILED.getStatusCode()).entity(statusMessage).build();
}
if(accessToken == null){
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.PRECONDITION_FAILED.getStatusCode());
statusMessage.setMessage("facebook access token value is missing...");
return Response.status(Status.PRECONDITION_FAILED.getStatusCode()).entity(statusMessage).build();
}
FacebookAuth facebookAuth = new FacebookAuth();
SocialUser fbUser = facebookAuth.verifySocialUser(accessToken);
if(fbUser == null){
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.FORBIDDEN.getStatusCode());
statusMessage.setMessage("Fail while verify facebook user...");
return Response.status(Status.FORBIDDEN.getStatusCode()).entity(statusMessage).build();
}
Users fb_user = usersDAO.validate(fbUser.getEmail(), null);
if(fb_user == null){
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.NOT_FOUND.getStatusCode());
statusMessage.setMessage("User not found...");
return Response.status(Status.NOT_FOUND.getStatusCode()).entity(statusMessage).build();
}
jweSerialization = getJWEToken(fb_user);
fb_user.setPassword(null); //not return password and OTP
fb_user.setOTP(null);
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.OK.getStatusCode());
statusMessage.setMessage(jweSerialization);
statusMessage.setData(fb_user);
logger.info("statusMessage : " + statusMessage);
return Response.status(Status.OK.getStatusCode()).entity(statusMessage).build();
case google:
if(email == null){
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.PRECONDITION_FAILED.getStatusCode());
statusMessage.setMessage("email value is missing...");
return Response.status(Status.PRECONDITION_FAILED.getStatusCode()).entity(statusMessage).build();
}
if(accessToken == null){
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.PRECONDITION_FAILED.getStatusCode());
statusMessage.setMessage("google access token value is missing...");
return Response.status(Status.PRECONDITION_FAILED.getStatusCode()).entity(statusMessage).build();
}
GoogleAuth googleAuth = new GoogleAuth();
SocialUser ggUser = googleAuth.verifySocialUser(accessToken);
if(ggUser == null){
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.FORBIDDEN.getStatusCode());
statusMessage.setMessage("Fail while verify Goolge user...");
return Response.status(Status.FORBIDDEN.getStatusCode()).entity(statusMessage).build();
}
Users gg_User = usersDAO.validate(ggUser.getEmail(), null);
if(gg_User == null){
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.NOT_FOUND.getStatusCode());
statusMessage.setMessage("User not found...");
return Response.status(Status.NOT_FOUND.getStatusCode()).entity(statusMessage).build();
}
jweSerialization = getJWEToken(gg_User);
gg_User.setPassword(null); //not return password and OTP
gg_User.setOTP(null);
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.OK.getStatusCode());
statusMessage.setMessage(jweSerialization);
statusMessage.setData(gg_User);
logger.info("statusMessage : " + statusMessage);
return Response.status(Status.OK.getStatusCode()).entity(statusMessage).build();
default:
statusMessage = new StatusMessage<Users>();
statusMessage.setStatus(Status.FORBIDDEN.getStatusCode());
statusMessage.setMessage("Wrong login type...");
return Response.status(Status.FORBIDDEN.getStatusCode()).entity(statusMessage).build();
}
}
