Planned lessonJNR-036-L07

Demo: securing the Shop API endpoint by endpoint

On This Lesson 3 topics

This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.

In this lesson

apply the rules to every Shop endpoint. Prepares JNR-036-LAB1.

Draft outline details

Add the Spring Security starter and see every endpoint become locked (401).
Write the chain: catalog GET public, cart and orders authenticated, catalog writes admin only.
Add DbUserDetailsService and seed one customer and one admin.
Planned mistake: put .anyRequest().permitAll() while debugging and forget it. Fix: replace with authenticated() and add a test that fails if an endpoint is open.
Add the 401 and 403 handlers with Problem Details.
Call each endpoint with curl as anonymous, customer, and admin.

Apply this lesson with the module's lab, exercises and quiz.

Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.