Ownership checks
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
make sure users reach only their own data.
Planned topics
- Take the user's identity from the authenticated principal, never from the request body or a parameter.
- Option 1: load then compare
order.getCustomerId()with the current user. - Option 2 (preferred): put ownership in the query:
findByIdAndCustomerId(id, customerId). - When it does not belong to you, return 404, not 403, so you do not reveal that it exists.
- Admins may bypass ownership through an explicit, tested path.
Draft outline details
Demonstration
Order order = orders.findByIdAndCustomerId(id, currentUser.id())
.orElseThrow(() -> new OrderNotFoundException(id));Check your understanding
Why return 404 instead of 403 for another customer's order?
Show answer
403 would confirm the order exists.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.