We have a spring mvc rest api, utilising spring security and hibernate to a MySql db.
We have some roles configured. For example:
Standard user: ROLEA
Super user: ROLEB
Currently to ensure that an authenticated user is authorised to access/update a certain resource we do something like this:
Identify the current authenticated user:
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
String activeLogin = authentication.getName();
Identify the login associated with the entity they are trying to access:
String loginAssociatedToRequestedEntity = fooService.getEntityA(EntityAId).getEntityB().getEntityC().getLogin();
Compare the user associated with given resource to active login:
if (!loginAssociatedToRequestedEntity.equals(activeLogin)) {
throw new ForbiddenAccessException();
}
I have a number of issues with this, some of these include:
- Very wasteful… each entity would have to be hydrated/populated. This could be even worse than the above example if the entity to be accessed is further away from the table with the login names in.
- Seems like a code smell (Law of Demeter).
- A request may come in that could update multiple entities. A similar check to the above may have to be repeated.
I have considered the following as possible options:
So my question is, is there a best practice to make sure an authenticated user is authorised to access a certain resource i.e. stopping them from accessing a resource of another user in the same role.
If you could point out a concrete example (github) that would be much appreciated.
TIA.