User context in rest application

Question

I have an angularjs application with rest java backend behind.

I want to limit each user to his context, like user can have access only to data that belongs him in relational database

(like, user can only have access to his calculations data, only to his files, etc).

What's the best approach to do that?

I can check if user have access to that data in each database query, but it looks like a lot of joins constructions, maybe there's another good way to solve that problem?

Thanks for you help

Answer 1

Since you mention that the backend is a REST backend, you could consider making each user's resources unique. This can be done by partitioning the user data over URLs. Here's a common way to do it:

http://api.example.com/users/1234/files
http://api.example.com/users/1234/files/6748
http://api.example.com/users/1234/stuff/32
http://api.example.com/users/5347/files
http://api.example.com/users/5347/stuff/218

When each resource is unique, it means that you can cache them, using HTTP cache headers. Perhaps you can set an HTTP reverse proxy up between the the client application and the REST API, so that caching is handled by off-the-shelf software.

The advantage of this is that even if the database queries are slow because of the joins, you may not hit the database too often, because most of the time the client is going to get the answers it needs from the reverse proxy (or its own cache).

Whether or not this is a good idea depends on the ratio between reads and writes, how up-to-date data has to be, etc. However, in the right circumstances, this architecture can be extremely effective.