CODEWITHSUNDEEP
javaplayframeworkauthorizationplayframework-2.3
Jaanus
Jaanus

Reputation: 16541

Play framework route parameter authorization

I have REST api on my page and for authentication I use the Play session.

Problem is with authorization, I have tens of endpoints looking like this:

GET          /api/domains/:domainId/properties/:propertyId/reports

I could add and if statement on each controller method to check whether user has permissions to that domain or property, but can I handle it somehow globally?

I found this module, but it does not seem to handle parameters, just checks if user is in some group/role or not. https://www.playframework.com/documentation/1.0.2.1/secure

Upvotes: 1

Views: 523

Answers (2)

FlashMan
FlashMan

Reputation: 26

I solved this using a custom RequestHandler. There you can extract parameters from the path and validate them. (In scala I could even modify the request route in order to avoid repeating these parameters in all routes, I don't know if you can do it in java too). (See: https://www.playframework.com/documentation/2.4.x/JavaHttpRequestHandlers)

Upvotes: 1

Gus
Gus

Reputation: 4517

You can use the Security.Authenticated annotation as detailed here. For more specific permissions, I recommend Deadbolt

Upvotes: 0

Related Questions