...

...

...

...

HTTPS

...

If you prefer using Spring Security then see how the authentication is handled in a spring-security demo.

Next, please see the Security Securing CXF Services section on how CXF Security interceptors can help.

...

CXF also provides two interceptors which make it easy to enforce authorization decisions, as described in the Security Securing CXF Services section.
CXF JAX-RS SimpleAuthorizingFilter can be used to wrap those interceptors and return 403 in case of failures:

...