Secured requests about openscoring HOT 1 CLOSED

There are two layers of security:

1. Physical layer - activating the HTTPS protocol, so that the transmitted data is safe from eavesdropping.
2. Logical layer - checking that end users are allowed to perform the requested action. Openscoring distinguishes between admin (read-write; reading private content) and non-admin user actions (read only; public content).

Tokens relate to logical layer security. They assume that you have already solved the physical layer security independently (eg. HTTPS ensures that other people can't see your tokens).

The default logical layer security is IP address-based - some network addresses are trusted, all the others are not:
https://github.com/openscoring/openscoring/tree/2.1.1/openscoring-service/src/main/resources/reference.conf#L12-L14

If you want to activate tokens, then you need to replace this config item with "org.openscoring.service.filters.TokenSecurityContextFilter":

application {
	componentClasses = [
		"org.openscoring.service.filters.TokenSecurityContextFilter"
	]
}

The implementation is here:
https://github.com/openscoring/openscoring/blob/2.1.1/openscoring-service/src/main/java/org/openscoring/service/filters/TokenSecurityContextFilter.java

Make all the necessary config changes, and then restart the service so that your custom config can take effect:
https://github.com/openscoring/openscoring/blob/2.1.1/openscoring-service/src/main/resources/reference.conf#L52-L61

The value of the admin token is re-generated on each service start - it's printed into the log file. You may want to replace it with some constant value.

from openscoring.