Loading published curriculum…

16 · Spring Security in depth / LESSON 82 OF 102

Method authorization and object ownership

Role checks answer broad permission questions; ownership checks protect individual resources.

Before this lesson: CORS, preflight, and credentialed requests

Understand the topic

Enable method security before using @PreAuthorize. hasRole("ADMIN") conventionally checks ROLE_ADMIN, whereas hasAuthority checks the literal authority. Calls must cross the managed proxy for method interception to apply.

Scope repository operations by both resource ID and authenticated owner. A hidden button is not authorization. Decide whether foreign resources return 403 or indistinguishable 404 responses, then test the policy at the HTTP and service boundaries.

EXAMPLE · JAVA

Service method fragment

@org.springframework.security.access.prepost.PreAuthorize("hasAuthority('task:read')")
public TaskView read(long id, long authenticatedOwnerId) {
 return repository.findByIdAndOwnerId(id, authenticatedOwnerId)
  .map(TaskView::from)
  .orElseThrow(TaskNotFoundException::new);
}

What to expect

Integration sketch requiring @EnableMethodSecurity, a repository method, DTO mapper, and exception. authenticatedOwnerId must come from trusted principal resolution, never arbitrary request input.

YOUR TURN

Put it into practice

  1. 01Create two users and tasks belonging to each.
  2. 02Attempt reads, updates, and deletes across owners, including direct service calls.
  3. 03Verify: No cross-owner operation succeeds even when the caller knows a valid resource ID.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

Role checks answer broad permission questions; ownership checks protect individual resources.

  1. 01Enable method security before using @PreAuthorize. hasRole("ADMIN") conventionally checks ROLE_ADMIN, whereas hasAuthority checks the literal authority. Calls must cross the managed proxy for method interception to apply.
  2. 02Scope repository operations by both resource ID and authenticated owner. A hidden button is not authorization. Decide whether foreign resources return 403 or indistinguishable 404 responses, then test the policy at the HTTP and service boundaries.
  3. 03Trace the example: Integration sketch requiring @EnableMethodSecurity, a repository method, DTO mapper, and exception. authenticatedOwnerId must come from trusted principal resolution, never arbitrary request input.

A mistake worth avoiding

Changing a numeric URL ID exposes another user’s task.

DEBUGGING ROOM

Something broke. Where do you look?

Changing a numeric URL ID exposes another user’s task.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Is hiding an Edit button sufficient authorization?

Choose one answer

BUILD IT YOURSELF

Create two users and tasks belonging to each.

  1. 1.Create two users and tasks belonging to each.
  2. 2.Attempt reads, updates, and deletes across owners, including direct service calls.
  3. 3.Reproduce this failure, then repair it: Changing a numeric URL ID exposes another user’s task.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Is hiding an Edit button sufficient authorization?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

No cross-owner operation succeeds even when the caller knows a valid resource ID.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references