Spring Security: allow user only to access their own administration page

Question

In my web app users are able to change their user details. The URL for this page is:

springproject/usermanagement/edituserinfo/4

where "4" is the user id.

My security-context looks like:

<security:http auto-config="true" use-expressions="true">
    <security:intercept-url pattern="/usermanagement" access="isAuthenticated()" />
    <security:intercept-url pattern="/usermanagement/new" access="hasRole('ROLE_ADMIN')" />
    <security:intercept-url pattern="/usermanagement/edit/*" access="hasRole('ROLE_ADMIN')" />
    <security:intercept-url pattern="/usermanagement/edituserinfo/*" access="isAuthenticated()" />  
</security:http>

How can I restrict the user only to access their own "edituserinfo" page? E.g. user with user id 1 can only access: "springproject/usermanagement/edituserinfo/1 " and not "springproject/usermanagement/edituserinfo/4 "

Do you really need to pass the user id in the URL? Ideally your URL should just be `springproject/usermanagement/edituserinfo`. You should retrieve the user id in the Java code as `SecurityContextHolder.getContext().getAuthentication().getPrincipal()` and use that to load the user details. This will make sure that a user is only able to see and edit their own details and no one else's. — manish, Apr 02 '15 at 02:41

score 14 · Answer 1 · edited Apr 02 '15 at 02:32

14

You can also accomplish this using Spring Security's @PreAuthorize which supports expressions:

@PreAuthorize("#userId == principal.id")
public void doSomething(@PathVariable String userId);

See the Spring docs:

Access Control using @PreAuthorize and @PostAuthorize

edited Apr 02 '15 at 02:32

Dijkgraaf

11,049
17
42
54

answered Apr 02 '15 at 02:08

dbmargo

141
1
3

score 11 · Accepted Answer · answered Jul 31 '11 at 15:56

Use a PathVariable on the URL, like @RequestMapping("/usermanagement/edituserinfo/{userid}") and in your code validate the logged-in user's Spring Security context principle (via SecurityContextHolder.getContext().getAuthentication().getPrincipal()) against the userid path variable. If they don't match, bounce the user out, log a SecurityException, and send an email to the admins.

Spring Security: allow user only to access their own administration page

2 Answers2

Linked