Method-Level Security

package com.javabytechie.shop.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableMethodSecurity // turns on @PreAuthorize, @PostAuthorize, @PreFilter and @PostFilter
public class SecurityConfig {

    // URL rules stay coarse: every API call needs a logged-in user.
    // Who may do what with which order is decided on the service methods.
    @Bean
    public SecurityFilterChain apiSecurity(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                .httpBasic(Customizer.withDefaults())
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .csrf(csrf -> csrf.disable()); // stateless API with HTTP Basic, no browser session
        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }

    // Demo users; a real shop would load them from a database or an identity provider
    @Bean
    public UserDetailsService users(PasswordEncoder encoder) {
        return new InMemoryUserDetailsManager(
                User.withUsername("asha").password(encoder.encode("asha-pass")).roles("CUSTOMER").build(),
                User.withUsername("ravi").password(encoder.encode("ravi-pass")).roles("CUSTOMER").build(),
                User.withUsername("meera").password(encoder.encode("meera-pass")).roles("SUPPORT").build(),
                User.withUsername("admin").password(encoder.encode("admin-pass")).roles("ADMIN").build());
    }
}

package com.javabytechie.shop;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class ShopApplication {

    public static void main(String[] args) {
        SpringApplication.run(ShopApplication.class, args);
    }
}

package com.javabytechie.shop.order;

import java.util.List;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.security.access.prepost.PostFilter;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.authorization.method.HandleAuthorizationDenied;
import org.springframework.stereotype.Service;

@Service
public class OrderService {

    private static final Logger log = LoggerFactory.getLogger(OrderService.class);

    private final OrderRepository orderRepository;

    public OrderService(OrderRepository orderRepository) {
        this.orderRepository = orderRepository;
    }

    // Only customers place orders, and only for themselves
    @PreAuthorize("hasRole('CUSTOMER') and #customer == authentication.name")
    public Order placeOrder(String customer, PlaceOrderRequest request) {
        Order order = new Order(orderRepository.nextId(), customer, request.sku(), request.total(),
                OrderStatus.PLACED, "PAY-" + System.nanoTime() % 100_000_000);
        log.info("{} placed {}", customer, order.id());
        return orderRepository.save(order);
    }

    // The owner, support and admins may read an order; checked after loading it
    @PostAuthorize("returnObject.customer() == authentication.name or hasAnyRole('SUPPORT', 'ADMIN')")
    public Order findById(String id) {
        return orderRepository.findById(id).orElseThrow(() -> new OrderNotFoundException(id));
    }

    // Customers see their own orders; support and admins see all of them
    @PostFilter("filterObject.customer() == authentication.name or hasAnyRole('SUPPORT', 'ADMIN')")
    public List<Order> findAll() {
        return orderRepository.findAll();
    }

    @PreAuthorize("@orderAccess.canCancel(#id, authentication)")
    public Order cancel(String id) {
        Order order = orderRepository.findById(id).orElseThrow(() -> new OrderNotFoundException(id));
        log.info("Cancelled {}", id);
        return orderRepository.save(order.withStatus(OrderStatus.CANCELLED));
    }

    @IsAdmin
    public Order refund(String id) {
        Order order = orderRepository.findById(id).orElseThrow(() -> new OrderNotFoundException(id));
        log.info("Refunded {}", id);
        return orderRepository.save(order.withStatus(OrderStatus.REFUNDED));
    }

    // Admins see the payment reference; everyone else gets "****" instead of a 403
    @PreAuthorize("hasRole('ADMIN')")
    @HandleAuthorizationDenied(handlerClass = MaskedValueHandler.class)
    public String paymentReference(String id) {
        return orderRepository.findById(id).orElseThrow(() -> new OrderNotFoundException(id)).paymentReference();
    }
}

package com.javabytechie.shop.order;

import org.springframework.security.core.Authentication;
import org.springframework.stereotype.Component;

// Rules too complex for one SpEL expression live in a bean, referenced as @orderAccess
@Component("orderAccess")
public class OrderAccess {

    private final OrderRepository orderRepository;

    public OrderAccess(OrderRepository orderRepository) {
        this.orderRepository = orderRepository;
    }

    // Customers may cancel their own orders until they ship; admins may cancel any order
    public boolean canCancel(String orderId, Authentication authentication) {
        if (hasRole(authentication, "ROLE_ADMIN")) {
            return true;
        }
        return orderRepository.findById(orderId)
                .map(order -> order.customer().equals(authentication.getName())
                        && order.status() == OrderStatus.PLACED)
                .orElse(true); // unknown order: let the service report 404 instead of 403
    }

    private static boolean hasRole(Authentication authentication, String role) {
        return authentication.getAuthorities().stream().anyMatch(a -> a.getAuthority().equals(role));
    }
}

package com.javabytechie.shop.order;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

import org.springframework.security.access.prepost.PreAuthorize;

// A meta-annotation: one readable name for a rule used in several places
@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("hasRole('ADMIN')")
public @interface IsAdmin {
}

package com.javabytechie.shop.order;

import org.aopalliance.intercept.MethodInvocation;
import org.springframework.security.authorization.AuthorizationResult;
import org.springframework.security.authorization.method.MethodAuthorizationDeniedHandler;
import org.springframework.stereotype.Component;

// Instead of throwing 403, a denied call returns a masked value
@Component
public class MaskedValueHandler implements MethodAuthorizationDeniedHandler {

    @Override
    public Object handleDeniedInvocation(MethodInvocation invocation, AuthorizationResult result) {
        return "****";
    }
}

package com.javabytechie.shop.order;

import java.math.BigDecimal;
import java.util.Comparator;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.atomic.AtomicInteger;

import org.springframework.stereotype.Repository;

// In memory to keep the example focused on security
@Repository
public class OrderRepository {

    private final Map<String, Order> orders = new ConcurrentHashMap<>();
    private final AtomicInteger sequence = new AtomicInteger(1000);

    public OrderRepository() {
        save(new Order("ORD-1001", "asha", "KB-100", new BigDecimal("89.00"), OrderStatus.PLACED, "PAY-7781-4410"));
        save(new Order("ORD-1002", "ravi", "MS-200", new BigDecimal("25.50"), OrderStatus.SHIPPED, "PAY-7781-4411"));
        save(new Order("ORD-1003", "asha", "HD-300", new BigDecimal("149.00"), OrderStatus.SHIPPED, "PAY-7781-4412"));
        sequence.set(1003);
    }

    public String nextId() {
        return "ORD-" + sequence.incrementAndGet();
    }

    public Order save(Order order) {
        orders.put(order.id(), order);
        return order;
    }

    public Optional<Order> findById(String id) {
        return Optional.ofNullable(orders.get(id));
    }

    public List<Order> findAll() {
        return orders.values().stream().sorted(Comparator.comparing(Order::id)).toList();
    }
}

package com.javabytechie.shop.order;

import java.net.URI;
import java.util.List;
import java.util.Map;

import org.springframework.http.ResponseEntity;
import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/api/orders")
public class OrderController {

    private final OrderService orderService;

    public OrderController(OrderService orderService) {
        this.orderService = orderService;
    }

    @PostMapping
    public ResponseEntity<OrderResponse> place(@RequestBody PlaceOrderRequest request, Authentication authentication) {
        Order order = orderService.placeOrder(authentication.getName(), request);
        return ResponseEntity.created(URI.create("/api/orders/" + order.id())).body(OrderResponse.from(order));
    }

    @GetMapping
    public List<OrderResponse> findAll() {
        return orderService.findAll().stream().map(OrderResponse::from).toList();
    }

    @GetMapping("/{id}")
    public OrderResponse findById(@PathVariable String id) {
        return OrderResponse.from(orderService.findById(id));
    }

    @PostMapping("/{id}/cancel")
    public OrderResponse cancel(@PathVariable String id) {
        return OrderResponse.from(orderService.cancel(id));
    }

    @PostMapping("/{id}/refund")
    public OrderResponse refund(@PathVariable String id) {
        return OrderResponse.from(orderService.refund(id));
    }

    @GetMapping("/{id}/payment-reference")
    public Map<String, String> paymentReference(@PathVariable String id) {
        return Map.of("paymentReference", orderService.paymentReference(id));
    }
}

package com.javabytechie.shop.order;

import org.springframework.http.HttpStatus;
import org.springframework.http.ProblemDetail;
import org.springframework.security.authorization.AuthorizationDeniedException;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RestControllerAdvice;

@RestControllerAdvice
public class OrderExceptionHandler {

    @ExceptionHandler(OrderNotFoundException.class)
    public ProblemDetail notFound(OrderNotFoundException ex) {
        return ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, ex.getMessage());
    }

    // Thrown by @PreAuthorize and @PostAuthorize when the rule says no
    @ExceptionHandler(AuthorizationDeniedException.class)
    public ProblemDetail denied(AuthorizationDeniedException ex) {
        return ProblemDetail.forStatusAndDetail(HttpStatus.FORBIDDEN, "You are not allowed to do this");
    }
}

package com.javabytechie.shop.order;

import java.math.BigDecimal;

public record Order(String id, String customer, String sku, BigDecimal total,
                    OrderStatus status, String paymentReference) {

    public Order withStatus(OrderStatus newStatus) {
        return new Order(id, customer, sku, total, newStatus, paymentReference);
    }
}

package com.javabytechie.shop.order;

import java.math.BigDecimal;

// What the API returns: no payment reference, which only admins may see
public record OrderResponse(String id, String customer, String sku, BigDecimal total, OrderStatus status) {

    static OrderResponse from(Order order) {
        return new OrderResponse(order.id(), order.customer(), order.sku(), order.total(), order.status());
    }
}

package com.javabytechie.shop.order;

import java.math.BigDecimal;

public record PlaceOrderRequest(String sku, BigDecimal total) {
}

package com.javabytechie.shop.order;

public enum OrderStatus {
    PLACED, SHIPPED, CANCELLED, REFUNDED
}

package com.javabytechie.shop.order;

public class OrderNotFoundException extends RuntimeException {

    public OrderNotFoundException(String id) {
        super("Order not found: " + id);
    }
}