CODEWITHSUNDEEP
javaspringrestsecurity
Almas Abdrazak
Almas Abdrazak

Reputation: 3612

How to secure rest api using permissions

I'm developing rest api service using spring boot, to check permission I use token as - Save key value to memcache in login request, key it's token(string) with length 50 and value it's your id. To have access to any rest request my rest controller get this token as get parameter(the same logic with post,put...) than i get id of user(from memcache) and check does this user has permission to specific resource.For example "carwashs/2 PUT" Car wash has FK to company, user also has FK to company, if these FK's are similar you have access to update car wash.I'm looking for another approach to secure my rest api using spring security because current method is not safety(i see token in url and use get parameters in all HTTP requestes). But in examples given in official docs it's seem that spring security only work with permisions enum and login page.

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth.inMemoryAuthentication().withUser("anon").password("123456").roles("USER");
      auth.inMemoryAuthentication().withUser("admin").password("123456").roles("ADMIN");
      auth.inMemoryAuthentication().withUser("userr").password("123456").roles("DBA");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

      http.authorizeRequests()
        .antMatchers("/admin/**").access("hasRole('ROLE_ADMIN')")
        .antMatchers("/dba/**").access("hasRole('ROLE_ADMIN') or hasRole('ROLE_DBA')")
        .and().formLogin();

    }
}

How to check permission to specific car wash using this approach?

Upvotes: 1

Views: 3109

Answers (1)

CanFil
CanFil

Reputation: 325

You can use common built-in expressions from spring security like

http.authorizeRequests().hasAuthority("ROLE_ADMIN").antMatchers("/dump/**")

or You can use Method security expressions with annotations like 

@PreAuthorize("#id == user.companyId")

And also you can look at there

https://docs.spring.io/spring-security/site/docs/3.0.x/reference/el-access.html

Upvotes: 2

Related Questions