Role-based authorization
On this page 8 topics
Overview
Topics
- RBAC
- method security
- ownership checks
Learn first
2.5 h of practice (estimate)
Learning outcomes
- Model roles and authorities and apply RBAC at URL and method level (
@PreAuthorize). - Enforce ownership checks so users can access only their own resources.
- Explain insecure direct object references (IDOR) and test for them.
- Decide where authorization logic belongs (filter, method, domain query).
Lessons
Lab and exercises
Lab
JNR-040-LAB1 · My orders only
Outcomes: 1–4 · Time: ~2.5 h Customers see only their own carts and orders; admins see all. Acceptance: a test where customer A requests customer B's order receives 404 (no existence leak).
Exercises (assessment: find IDOR bugs in a provided API)
| ID | Outcome | Task |
|---|---|---|
| JNR-040-EX01 | 1 | Define roles and authorities for Shop (customer, admin) and map five endpoints to them. |
| JNR-040-EX02 | 1 | Protect OrderService.listAll() with @PreAuthorize and say what else must be enabled. |
| JNR-040-EX03 | 2 | Rewrite findById(id) so it only returns the caller's order. |
| JNR-040-EX04 | 2 | A create-order request body contains customerId. Explain the risk and fix it. |
| JNR-040-EX05 | 3 | In a provided API, find three IDOR bugs (read, update, delete) and write the attack request for each. |
| JNR-040-EX06 | 3 | Write a MockMvc test where customer A requests customer B's order. |
| JNR-040-EX07 | 4 | For each rule, pick filter, method, or query: "must be logged in"; "only admins list all orders"; "only own orders". |
Show solutions
- EX01 For example:
GET /api/productspublic;POST /api/productsADMIN;GET /api/orders/{id}CUSTOMER with ownership;GET /api/ordersADMIN;POST /api/ordersCUSTOMER. - EX02
@PreAuthorize("hasRole('ADMIN')")and@EnableMethodSecurityon a configuration class. - EX03
findByIdAndCustomerId(id, currentUserId); empty result leads to 404. - EX04 A customer could place orders as someone else; take the customer from the authenticated principal and delete the field from the request.
- EX05 Change the ID in
GET,PUT, andDELETErequests while logged in as another customer; each returns the other's data or modifies it. - EX06 Log in as A, request B's order id,
status().isNotFound(). - EX07 Must be logged in: filter (URL rule); only admins list all: method security; only own orders: domain query.
Quiz
Outcomes: O1 roles and method security · O2 ownership checks · O3 IDOR · O4 where authorization belongs.
A self-check for you: nothing is graded, saved or sent anywhere. Choose an answer, then check it. You can try again as often as you like.
Practical part
Seven exercises JNR-040-EX01 to EX07 plus the lab; finding IDOR bugs in the provided API (EX05) is the assessment. Pass: at least six exercises correct, all three IDOR bugs found, and the 404 test passing.
Common mistakes
Checking roles but not ownership; trusting a customerId from the request body.
Assessment
Find IDOR bugs in a provided API.
Career relevance
Broken access control is the top OWASP risk; authorization design in MID-051.