title: Custom JAX-RS authorization - using JWT in each request
body: <p>I have a JAX-RS service where I want all my users to access my services, but just those who have rights to see the result. Roles based security and existing REALMS and atuhentication methods doesn't fit my requirement.</p>
  
  <p>For example:</p>
  
  <ol>
  <li>user authenticates against one REST service and I send him JWT token with his ID</li>
  <li>user asks for other resource and sends his JWT with his ID in each request</li>
  <li>I check his user id (from JWT) and if the business logic returns result I send them back, else I send empty result set or specific HTTP status</li>
  </ol>
  
  <p>Question is: Where should I check for users ID, in some separate filter, security context or in every REST method implementation? How to provide REST methods with this ID, can securityContext be injected in every method after filtering request by ID?</p>
  
  <p>I'm using GlassFish 4.1 and Jersey JAX-RS implementation.</p>