Where to store authentication token in RESTful API? - rest

Question

I want to secure the REST URL. For that I have decided to go with token based authentication. In that, how can I create the token with expiration time and where can I store it for later validation token check ?
Thanks in advance.
This is my security.xml
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd">
<beans:import resource="applicationContext.xml"/>
<http pattern="/jaxrs/employess/**" create-session="stateless" entry-point-ref="myAuthenticationEntryPoint">
<intercept-url pattern='/jaxrs/employess/**' />
<custom-filter position="PRE_AUTH_FILTER" ref="myAuthenticationFilter" />
</http>
<beans:bean id="myAuthenticationEntryPoint" class="restservice.security.MyAuthenticationEntryPoint"/>
<global-method-security secured-annotations="enabled" />
<beans:bean id="myAuthenticationFilter" class="restservice.security.MyAuthenticationFilter">
<beans:property name="authenticationManager" ref="authenticationManager"/>
</beans:bean>
<authentication-manager alias="authenticationManager">
<authentication-provider ref="myAuthenticationProvider"/>
</authentication-manager>
<!--<beans:bean id="restTemplate" class="org.springframework.web.client.RestTemplate"/>-->
<beans:bean id="restTemplate" class="org.springframework.web.client.RestTemplate">
<!-- <beans:property name="errorHandler" ref="customErrorHandler" /> -->
</beans:bean>
<beans:bean id="myAuthenticationProvider" class="restservice.security.MyAuthenticationProvider" >
<beans:property name="restTemplate" ref="restTemplate"/>
</beans:bean>
<!-- <beans:bean id="customErrorHandler" class="com.AuthenticationResponseErrorHandler"/> -->
</beans:beans>*

Answer 1

You shouldn't store it anywhere, since that would imply storing some session state on the server.
Instead, the token itself should be a signed encoded string with the information you need to identify the user. You verify its authenticity by checking the signature. If you need to expire it, just append a time stamp to it before signing and calculate the token age based on the current time.