Spring HATEOAS Link Security

2
votes

I have a question concerning security in exposed REST APIs via Spring Date / HATEOAS:

Reqeusts for an entity will result in responses like these:

{
  "id": 1,
  "someAttr": "val",
  "_links": {
    "someCollection": {
      "href": "http://localhost:8080/entities/1/someCollection"
    }
  }
}

The entity is currently exposed via Spring Data's ability to export Repositories automatically.

The question for me now is: How can I add security configuration to these kind of link endpoints? They will be a bit more complex (eg testing if the requesting user owns the entity which links to the collection).

Thanks in advance!

1
springspring-securityspring-bootspring-dataspring-hateoas
@Secured is supported on repository methods, sorry that I don't have an example I've never actually had to do it. You can also set up access to the security context via SpEL. - xenoterracide

1 Answers