Planned lessonJNR-040-L06

Demo: method security with ownership checks

On This Lesson 3 topics

This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.

In this lesson

combine roles and ownership in the service layer. Prepares JNR-040-LAB1.

Draft outline details

Enable method security.
Add @PreAuthorize("hasRole('ADMIN')") to the "list all orders" service method.
Add a service method getMyOrders(currentUser) that filters by owner.
Remove customerId from the create-order request body and take it from the principal.
Planned mistake: leaving the customerId in the body, so customer A creates an order for B. Show the attack, then fix.
Add tests for customer A, customer B, and admin.

Apply this lesson with the module's lab, exercises and quiz.

Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.