Authors:
Marc Hüffmeyer
1
;
Florian Haupt
2
;
Frank Leymann
2
and
Ulf Schreier
1
Affiliations:
1
Hochschule Furtwangen, Germany
;
2
University of Stuttgart, Germany
Keyword(s):
REST, Web Services, Authorization, Attribute Based Access Control.
Related
Ontology
Subjects/Areas/Topics:
Cloud Computing
;
Collaboration and e-Services
;
Data Engineering
;
e-Business
;
Enterprise Information Systems
;
Mobile Software and Services
;
Ontologies and the Semantic Web
;
Services Science
;
Software Agents and Internet Computing
;
Software Engineering
;
Software Engineering Methods and Techniques
;
Telecommunications
;
Web Services
;
Wireless Information Networks and Systems
Abstract:
The architectural style named Representational State Transfer (REST) is nowadays widely established and still
enjoys a growing popularity. One of the core principles of REST is referred as ”Hypermedia as the Engine of
Application State” (HATEOAS). HATEOAS is one of the foundations of the scalability that RESTful systems
provide and enables the decoupling of client and server. But the realization of HATEOAS is challenging,
because there is no systematic approach how to enforce the constraint. Therefore, the implementation is
mostly up to the developer of a RESTful service. This work describes a new method of how to apply the
HATEOAS constraint. We describe a method that systematically enables HATEOAS based on REST API
models and the integration of access control mechanisms. In order to avoid unauthorized access attempts and
unnecessary network traffic, the resource representations are customized to the requesting subject. References
that lead to not accessible resources, are not inclu
ded in the customized resource representations. Therefore, an
attribute based access control mechanism is extended to distinguish between static and dynamic attributes. A
2-phase authorization procedure is introduced that relies on this discrimination and determines the references
which must be included in the resource representation. The result is a flexible realization of HATEOAS based
on formal models.
(More)