What is the best way to secure Pedestal REST-endpoints?

@skylar: I haven't gotten to using it yet, but https://github.com/propan/geheimtur has been recommended to me when I asked about it earlier.

Are there any examples of how to use the resource ring-middleware (https://github.com/pedestal/pedestal/blob/master/service/src/io/pedestal/http/ring_middlewares.clj#L142) or any of the other ring-middleware that takes an argument? It's just different enough from the examples I can find (for both ring and pedestal) that it's giving me a bit of difficulty figuring out. I think I'm almost there but not sure yet if what I'm trying is just a terrible mess compared to what it could be.

@shaun-mahood, the ring resource middleware is used when :io.pedestal.http/resource-path is set on the service-map. Refer to https://github.com/pedestal/pedestal/blob/master/service/src/io/pedestal/http.clj#L256. All the middleware adapters in the io.pedestal.http.ring-middlewares namespace are just functions which return interceptors. To use them, you would invoke the functions when building your interceptor chain. A lot of them are configured through the default-interceptors fn, though. Take a deeper look there for more details. https://github.com/pedestal/pedestal/blob/master/service/src/io/pedestal/http.clj#L181

@skylar another authentication option is Buddy (https://github.com/funcool/buddy). There’s a PR which includes an a Buddy auth integration sample project. https://github.com/pedestal/pedestal/pull/503.

@ddeaguiar: Maybe I'm going down the wrong path then - what I'm trying to do is grab a file from the local filesystem (not in the resource-path) and serve that file. My thought was that I could use one of the existing ring-middlewares and pass in the specific file path. At this point I've got an interceptor that grabs the info from the request and does a query to find the file-path and adds that to the context, and I want to have that file-path sent to the resource middleware (or one of the alternatives) - so for now I'm trying to just wrap it with another interceptor that passes in the file-path. My first thought was to just put the argument (or the path to the context) into the interceptor chain directly, but I couldn't find a way to do that. What you posted above helps since I was making one wrong assumption already, so thanks!

Harumph... the war example seems broken.... https://github.com/pedestal/pedestal/issues/527

any ideas on how to poke at this one?

@bherrmann I'll take a look at this. I've needed to understand how war deployment works for a while. (I never worked on that part before.) What I see at the moment looks like a missing Jar file for the servlet API.

@bherrmann OK, I figured out what was going on. In the war example, we don't have Jetty in the dependencies. That's so the war file doesn't contain a complete copy of Jetty, Tomcat, etc.

Instead, there's a profile in project.clj that you need to add for REPL based development only.

So if you run 'lein with-profile +jetty repl' you get the desired behavior.

I've pushed an update to the readme that clarifies this process.

As an aside, one thing I'd really love to have is build automation that could start up and test each of the samples during a CI build...

((io.pedestal.http.route/form-action-for-routes
   #{["/" :get (fn [_] {:status 200 :body "Hello"}) :route-name :main]}) :main)

@souenzzo I think form-action-for-routes needs the fully-expanded routes. Can you try the same thing with the value of (:io.pedestal.http/routes service-map) after starting the service?

(let [routes #{["/" :get (fn [_] {:status 200 :body "Hello"}) :route-name :main]}
      service {::bootstrap/routes routes
               ::bootstrap/join?  false
               ::bootstrap/type   :jetty
               ::bootstrap/port   8080}
      server (bootstrap/create-server service)]
  ((io.pedestal.http.route/form-action-for-routes (::bootstrap/routes server)) :main))

ExceptionInfo Route not found  clojure.core/ex-info (core.clj:4617)

@souenzzo I have to head out for dinner. I'll check back in later. Let me know if that doesn't work and I can dig some more.

OK, I'll try to diagnose further later.

@mtnygard Huh. While you looked at that, I was writting up this, https://github.com/pedestal/pedestal/issues/529

@mtnygard Your "lein with-profile +jetty repl" does work for the REPL case though.

I wonder if using a WAR file is just weird. It doesnt appear to be the path most traveled.