We had a requirement in a recent project to expose some of the functionality we had via a JSON API. The functionality needed to be secure, as was the initial web interface which exposed the functionality. We were using Spring Security for the security aspect of our application.<\/p>\n
The spring security plugin, together with a secured controller and a custom JSON marshaller(which overrides the default functionality of render as JSON method) gave us a very simple, yet elegant and powerful JSON API which was secure. Here are the three steps that we followed<\/p>\n
1. Setting up Spring Security Plugin: <\/strong><\/p>\n The first step is to set up Spring Security Plugin to expose our JSON based controllers to use Basic Authentication, instead of the standard web-based authentication. This is done by adding the lines given below in Config.groovy<\/p>\n [java] More details about the authentication mechanism can be found here. Naturally, this is the next step. We added a controller which would expose the functionalities required(another reason why most of our logic should be in our services instead of controllers). A sample controller would look like this.<\/p>\n [java] @Secured(["ROLE_USER"]) 3. Customizing the Marshaller to change the way some properties like enums are rendered:<\/strong><\/p>\n We had to change the way some of the properties like enums were going to be rendered. We just had to render the property name and the id of the enum. So instead of a JSON map like<\/p>\n [java]<\/p>\n "genre":{"enumType":"com.intelligrape.example.json.Book$Genre","name":"FICTION"}<\/p>\n [\/java]<\/p>\n we needed<\/p>\n [java]<\/p>\n "genre":"FICTION"<\/p>\n [\/java]<\/p>\n I sought help from David Bower’s post and created my own custom Domain Class Marshaller for JSON with a modification to just use the Enum value if the property happened to be an enum. This is a very powerful feature because it allows us to customize the way in which we want to render the values when creating a JSON or XML document from our classes. We can even customize it to have an excludes <\/em>list in our domain class where we can specify the properties to be excluded while constructing our JSON or XML<\/p>\n With this, we had a JSON API ready in very little time. I have extracted the functionality into a small example application, which has been shared on Github<\/a>.<\/p>\n
\n\/\/Enable Basic Auth Filter
\ngrails.plugins.springsecurity.useBasicAuth = true
\ngrails.plugins.springsecurity.basic.realmName = "JSON API Example"
\n\/\/Exclude normal controllers from basic auth filter. Just the JSON API is included
\ngrails.plugins.springsecurity.filterChain.chainMap = [
\n‘\/json\/**’: ‘JOINED_FILTERS,-exceptionTranslationFilter’,
\n‘\/**’: ‘JOINED_FILTERS,-basicAuthenticationFilter,-basicExceptionTranslationFilter’
\n]
\n[\/java]<\/p>\n
\n2. Adding a Controller with required actions:<\/strong><\/p>\n
\npackage jsonapi
\nimport grails.plugins.springsecurity.Secured
\nimport grails.converters.JSON
\nimport com.intelligrape.example.json.Book<\/p>\n
\nclass JsonController {
\n def getBooks = {
\n render Book.list() as JSON
\n }
\n}
\n[\/java]<\/p>\n