Question

I have a REST web service using spring MVC which is external-facing.
I would like to restrict access to some REST calls for admin usage and for other servers on the same internal network to call.

So far I can think of the following solutions:

1. Use Spring-Security to restrict a mapping to a subnet using “hasIpAddress” access
2. Separate the sensitive REST calls into their own controller and Write an AOP pointcut which reads the HttpServletRequest for the IP address and check against a whitelist

I’m not fond of either solution. (1) doesn’t give me enough flexibility, I may be on several subnets, and may only want to open up an IP range. (2) Gives me nearly exactly what I want but it seems hacky, there must be a better way to do this.

Answer 1

(2) why do you not want to use the “standard” annotations like @PreAuthrize. You can put them at the methods, so you do not need to move the sensitive REST methods to an other controller.