Oauth2 get Username from token

Question

I have implemented Ouath2 as security for my Spring boot rest controllers. Before any of my resource is called, oauth2 validates the token for the users in user table. My question is how to avoid situation where if user1 token is in the request and the request body has data for user2 modification? I need to put a check such that User1 with his token should be able to modify data only for himself. If user1 with his toekn has user2 data in request body should throw 403.

I was thinking if i can get username from token at service layer to do this check? Any help appreciated

Answer 1

You are using Spring Security for authentication.

You can get User Detail from SecurityContext

Authentication authentication = SecurityContextHolder.getContext()
    .getAuthentication();

UserDetails userDetail = authentication.getPrincipal();
userDetail.getUsername();

or in Rest Controller

@RequestMapping(value = "/username", method = RequestMethod.GET)
public String currentUserName(Principal principal) {
    return principal.getName();
}

or

@RequestMapping(value = "/username", method = RequestMethod.GET)
public String currentUserName(HttpServletRequest request) {
    Principal principal = request.getUserPrincipal();

    return principal.getName();
}