How to secure Spring Data REST associations requests?How to use java.net.URLConnection to fire and handle HTTP requestsHow to configure port for a Spring Boot applicationSpring data REST: Update a resource´s association using proper HTTP methodSpring Data Rest - _linksAdding associated elements with Spring Data REST and Restangularbest way to save child resource Spring Data RESTHow to avoid Spring Data Rest throwing HTTP 400 when an AccessDeniedException occurs on a controllerSpring Rest API Oauth2 SecurityExposing both parent and child entities as REST repositories in Spring Data RESTSaving Multipart Form Data With Spring Security giving error HTTP Status 405 - Request method 'POST' not supported
Etymology of 'calcit(r)are'?
Last survivors from different time periods living together
Phone number to a lounge, or lounges generally
How many pairs of subsets can be formed?
Can an Eldritch Knight use Action Surge and thus Arcane Charge even when surprised?
How Can I Tell The Difference Between Unmarked Sugar and Stevia?
Why does the Schrödinger equation work so well for the Hydrogen atom despite the relativistic boundary at the nucleus?
Was the Tamarian language in "Darmok" inspired by Jack Vance's "The Asutra"?
Russian equivalents of "no love lost"
Does an ice chest packed full of frozen food need ice?
What can cause the front wheel to lock up when going over a small bump?
Efficient integer floor function in C++
Company did not petition for visa in a timely manner. Is asking me to work from overseas, but wants me to take a paycut
Should an arbiter claim draw at a K+R vs K+R endgame?
What can plausibly explain many of my very long and low-tech bridges?
When writing an error prompt, should we end the sentence with a exclamation mark or a dot?
Version 2 - print new even-length arrays from two arrays
What does the "c." listed under weapon length mean?
How can drunken, homicidal elves successfully conduct a wild hunt?
Required to check-in in person at international layover airport
What risks are there when you clear your cookies instead of logging off?
Is any name of Vishnu Siva?
How to translate “Me doing X” like in online posts?
What's up with this leaf?
How to secure Spring Data REST associations requests?
How to use java.net.URLConnection to fire and handle HTTP requestsHow to configure port for a Spring Boot applicationSpring data REST: Update a resource´s association using proper HTTP methodSpring Data Rest - _linksAdding associated elements with Spring Data REST and Restangularbest way to save child resource Spring Data RESTHow to avoid Spring Data Rest throwing HTTP 400 when an AccessDeniedException occurs on a controllerSpring Rest API Oauth2 SecurityExposing both parent and child entities as REST repositories in Spring Data RESTSaving Multipart Form Data With Spring Security giving error HTTP Status 405 - Request method 'POST' not supported
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I'v created REST API using Spring Data REST. I have entity User and Post, where User can have multiple posts (One to Many). Now I need to add posts to my user. But I need that userA can't have possibilities to delete or update posts of userB.
Api structure
"_links":
"users":
"href": "http://localhost:8081/api/users?page,size,sort",
"templated": true
,
"posts":
"href": "http://localhost:8081/api/posts?page,size,sort",
"templated": true
"profile":
"href": "http://localhost:8081/api/profile"
User structure
"id": 1,
"username": null,
"password": null,
"_links":
"self":
"href": "http://localhost:8081/api/users/1"
,
"user":
"href": "http://localhost:8081/api/users/1"
,
"posts":
"href": "http://localhost:8081/api/users/1/posts"
There are several ways to add related entity throw links.
Using PUT method and text/uri-list content type:
PUT /api/posts/1/user? HTTP/1.1
Host: localhost:8081
Content-Type: text/uri-list
Authorization: Bearer 270c6dc3-04a5-48cc-b42e-c275472df459
cache-control: no-cache
http://localhost:8081/api/users/1
But with this way I can add any URI to body and add any random user to random post, and I think, there is a security problem here.
Next method to add related resource is to add it in JSON like this:
PATCH /api/posts/1? HTTP/1.1
Host: localhost:8081
Content-Type: application/json
Authorization: Bearer 270c6dc3-04a5-48cc-b42e-c275472df459
cache-control: no-cache
"user": "http://localhost:8081/api/users/1"
But and in this method the same problem. Any user can be added to any post.
Now I see only one solve of this problem - is customizing rest repository and check if added user is current authenticated user.
java spring spring-security spring-data-rest
asked Mar 24 at 15:30
John DevJohn Dev
61
add a comment |
I'v created REST API using Spring Data REST. I have entity User and Post, where User can have multiple posts (One to Many). Now I need to add posts to my user. But I need that userA can't have possibilities to delete or update posts of userB.
Api structure
"_links":
"users":
"href": "http://localhost:8081/api/users?page,size,sort",
"templated": true
,
"posts":
"href": "http://localhost:8081/api/posts?page,size,sort",
"templated": true
"profile":
"href": "http://localhost:8081/api/profile"
User structure
"id": 1,
"username": null,
"password": null,
"_links":
"self":
"href": "http://localhost:8081/api/users/1"
,
"user":
"href": "http://localhost:8081/api/users/1"
,
"posts":
"href": "http://localhost:8081/api/users/1/posts"
There are several ways to add related entity throw links.
Using PUT method and text/uri-list content type:
PUT /api/posts/1/user? HTTP/1.1
Host: localhost:8081
Content-Type: text/uri-list
Authorization: Bearer 270c6dc3-04a5-48cc-b42e-c275472df459
cache-control: no-cache
http://localhost:8081/api/users/1
But with this way I can add any URI to body and add any random user to random post, and I think, there is a security problem here.
Next method to add related resource is to add it in JSON like this:
PATCH /api/posts/1? HTTP/1.1
Host: localhost:8081
Content-Type: application/json
Authorization: Bearer 270c6dc3-04a5-48cc-b42e-c275472df459
cache-control: no-cache
"user": "http://localhost:8081/api/users/1"
But and in this method the same problem. Any user can be added to any post.
Now I see only one solve of this problem - is customizing rest repository and check if added user is current authenticated user.
java spring spring-security spring-data-rest
asked Mar 24 at 15:30
John DevJohn Dev
61
add a comment |
I'v created REST API using Spring Data REST. I have entity User and Post, where User can have multiple posts (One to Many). Now I need to add posts to my user. But I need that userA can't have possibilities to delete or update posts of userB.
Api structure
"_links":
"users":
"href": "http://localhost:8081/api/users?page,size,sort",
"templated": true
,
"posts":
"href": "http://localhost:8081/api/posts?page,size,sort",
"templated": true
"profile":
"href": "http://localhost:8081/api/profile"
User structure
"id": 1,
"username": null,
"password": null,
"_links":
"self":
"href": "http://localhost:8081/api/users/1"
,
"user":
"href": "http://localhost:8081/api/users/1"
,
"posts":
"href": "http://localhost:8081/api/users/1/posts"
There are several ways to add related entity throw links.
Using PUT method and text/uri-list content type:
PUT /api/posts/1/user? HTTP/1.1
Host: localhost:8081
Content-Type: text/uri-list
Authorization: Bearer 270c6dc3-04a5-48cc-b42e-c275472df459
cache-control: no-cache
http://localhost:8081/api/users/1
But with this way I can add any URI to body and add any random user to random post, and I think, there is a security problem here.
Next method to add related resource is to add it in JSON like this:
PATCH /api/posts/1? HTTP/1.1
Host: localhost:8081
Content-Type: application/json
Authorization: Bearer 270c6dc3-04a5-48cc-b42e-c275472df459
cache-control: no-cache
"user": "http://localhost:8081/api/users/1"
But and in this method the same problem. Any user can be added to any post.
Now I see only one solve of this problem - is customizing rest repository and check if added user is current authenticated user.
java spring spring-security spring-data-rest
asked Mar 24 at 15:30
John DevJohn Dev
61
I'v created REST API using Spring Data REST. I have entity User and Post, where User can have multiple posts (One to Many). Now I need to add posts to my user. But I need that userA can't have possibilities to delete or update posts of userB.
Api structure
"_links":
"users":
"href": "http://localhost:8081/api/users?page,size,sort",
"templated": true
,
"posts":
"href": "http://localhost:8081/api/posts?page,size,sort",
"templated": true
"profile":
"href": "http://localhost:8081/api/profile"
User structure
"id": 1,
"username": null,
"password": null,
"_links":
"self":
"href": "http://localhost:8081/api/users/1"
,
"user":
"href": "http://localhost:8081/api/users/1"
,
"posts":
"href": "http://localhost:8081/api/users/1/posts"
There are several ways to add related entity throw links.
Using PUT method and text/uri-list content type:
PUT /api/posts/1/user? HTTP/1.1
Host: localhost:8081
Content-Type: text/uri-list
Authorization: Bearer 270c6dc3-04a5-48cc-b42e-c275472df459
cache-control: no-cache
http://localhost:8081/api/users/1
But with this way I can add any URI to body and add any random user to random post, and I think, there is a security problem here.
Next method to add related resource is to add it in JSON like this:
PATCH /api/posts/1? HTTP/1.1
Host: localhost:8081
Content-Type: application/json
Authorization: Bearer 270c6dc3-04a5-48cc-b42e-c275472df459
cache-control: no-cache
"user": "http://localhost:8081/api/users/1"
But and in this method the same problem. Any user can be added to any post.
Now I see only one solve of this problem - is customizing rest repository and check if added user is current authenticated user.
java spring spring-security spring-data-rest
java spring spring-security spring-data-rest
asked Mar 24 at 15:30
John DevJohn Dev
61
asked Mar 24 at 15:30
John DevJohn Dev
61
asked Mar 24 at 15:30
John DevJohn Dev
61
asked Mar 24 at 15:30
John DevJohn Dev
61
asked Mar 24 at 15:30
John DevJohn Dev
61
61
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Looking at your use case "Only User is responsible for CRUD operation on its POST"
Yes one way of solving this would be "is customizing rest repository and check if added user is current authenticated user."
Assuming you have Spring Security
I would suggest you don't pass any User id for your Posts and pick up User from Logged in User ID from Security Context or from Token.
This way your post will be independent of User at API level.
answered Mar 25 at 6:02
MyTwoCentsMyTwoCents
3,61021131
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55325400%2fhow-to-secure-spring-data-rest-associations-requests%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Looking at your use case "Only User is responsible for CRUD operation on its POST"
Yes one way of solving this would be "is customizing rest repository and check if added user is current authenticated user."
Assuming you have Spring Security
I would suggest you don't pass any User id for your Posts and pick up User from Logged in User ID from Security Context or from Token.
This way your post will be independent of User at API level.
answered Mar 25 at 6:02
MyTwoCentsMyTwoCents
3,61021131
add a comment |
Looking at your use case "Only User is responsible for CRUD operation on its POST"
Yes one way of solving this would be "is customizing rest repository and check if added user is current authenticated user."
Assuming you have Spring Security
I would suggest you don't pass any User id for your Posts and pick up User from Logged in User ID from Security Context or from Token.
This way your post will be independent of User at API level.
answered Mar 25 at 6:02
MyTwoCentsMyTwoCents
3,61021131
add a comment |
Looking at your use case "Only User is responsible for CRUD operation on its POST"
Yes one way of solving this would be "is customizing rest repository and check if added user is current authenticated user."
Assuming you have Spring Security
I would suggest you don't pass any User id for your Posts and pick up User from Logged in User ID from Security Context or from Token.
This way your post will be independent of User at API level.
answered Mar 25 at 6:02
MyTwoCentsMyTwoCents
3,61021131
Looking at your use case "Only User is responsible for CRUD operation on its POST"
Yes one way of solving this would be "is customizing rest repository and check if added user is current authenticated user."
Assuming you have Spring Security
I would suggest you don't pass any User id for your Posts and pick up User from Logged in User ID from Security Context or from Token.
This way your post will be independent of User at API level.
answered Mar 25 at 6:02
MyTwoCentsMyTwoCents
3,61021131
answered Mar 25 at 6:02
MyTwoCentsMyTwoCents
3,61021131
answered Mar 25 at 6:02
MyTwoCentsMyTwoCents
3,61021131
answered Mar 25 at 6:02
MyTwoCentsMyTwoCents
3,61021131
3,61021131
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55325400%2fhow-to-secure-spring-data-rest-associations-requests%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
