Securing exclusively the REST access to a Spring Data Rest Repository

Question

I'm using Spring Data Rest to expose a repository. I'm using @PreAuthorize and @PostFilter to restrict the access to the REST end points to exclusively admin users and filter the results.

@PreAuthorize("hasRole('ROLE_ADMIN')")
@PostFilter("hasPermission(filterObject, 'read')
public interface SomeRepository extends CrudRepository<SomeEntity, Long> {
}

At the same time I have another Controller that doesn't require any authentication but is using the repository.

@Controller
public class SomeController {

 @Autowired
 SomeRepository repository;

 @RequestMapping(value = "/test")
 public ResponseEntity test () {
 // Do something
 repository.findAll();
 // Do something else
 }
}

This doesn't work because the user that send the request to "/test" is not admin so it doesn't have access to the repository.

My question is, it is possible to add security exclusively to the REST interface of the repository and not when the repository is used internally in the application?

Thanks

Answer 1

Please evaluate these possibilities:

• Security checks in REST event handlers
• Adding custom repository methods for internal use
• Using RunAsManager (or temporarily switching SecurityContext to perform a privileged operation)

Securing modifying requests using REST event handlers:

@Service
@RepositoryEventHandler
public class FooService {

  /**
   * Handles before-* events.
   */
  @HandleBeforeCreate
  @HandleBeforeSave
  @HandleBeforeDelete
  @PreAuthorize("hasRole('ADMIN')")
  public void onBeforeModify(final Foo entity){
    // noop
  }

  /**
   * Handles before-* events.
   */
  @HandleBeforeLinkSave
  @HandleBeforeLinkDelete
  @PreAuthorize("hasRole('ADMIN')")
  public void onBeforeModifyLink(final Foo entity, final Object linked){
    // noop
  }
}

Securing standard CRUD methods while adding non-secure custom methods on repository for internal use:

public interface FooDao extends CrudRepository<Foo, Long> {

 @Override
 @PreAuthorize("hasRole('ADMIN')")
 <S extends Foo> S save(final S entity);

  /**
   * Saves entity without security checks.
   */
  @Transactional
  @Modifying
  default <S extends Foo> S saveInternal(final S entity) {
    return save(entity);
  }
}