Home/ Questions/Q 9156987
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T12:54:10+00:00

I’ve some RESTful services, implemented with Spring MVC, exposing a set of resources. I

  • 0

I’ve some RESTful services, implemented with Spring MVC, exposing a set of resources. I already use authentication, based on HTTPBasicAuthentication and HTTPS. Some of the resources must be accessible only to some users.

For example, I want that all sub-resources in the URI /users/{userid}/photos are accessible only to the user userid. Actually in my application they are accessible to all authenticated users. How can I protect them from other users except userid?
And what if I want to allow access to this resources only to a subset of users (like, for example, userid‘s friends)?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I solved it by using @PreAuthorize("authentication.name == #userId"), instead of @Secured(value = {"userid"}) or @Secured(value = {"#userid"}) like suggested, that were not working.

    Note it’s necessary to add <security:global-method-security pre-post-annotations="enabled"/> to the servlet context configuration file.

    • 0