How to allow a User only access their own data in Spring Boot / Spring Security?

Question

I have some rest api like this:

/users/{user_id}
/users/{user_id}/orders
/users/{user_id}/orders/{order_id}

How I must secure them? every u

Answer 1

You should first choose your security strategy, What you need names "Row Filtering", one of Authorization Concepts of 3A( Authentication, Authorization,Audit ) Concepts.

If you want to implement comprehensive solution, take a look at :

https://docs.spring.io/spring-security/site/docs/3.0.x/reference/domain-acls.html

Spring ACL completely covers concepts like "Row Filtering", "White-Black List", "Role Base Authorization", "ACL Inheritance", "Role Voter", ....

Otherwise you should save the owner per business case you want to be secured and filter them in your Service Layer.