如何在 Spring-boot 中成功登录后限制 POST Rest Api 进行公共访问

Question

I am a new in JAVA/Springboot, I want to restrict POST rest api to access publicly.

Once user login successfully, the API is currently accessible publicly and able to add update data. I want to restrict it and only accessible privately.My aim is to restrict unauthorised user to add or update data publicly and it should be privatly accessible.

Thank You...

Answer 1

You can make use of preAuthorize

@PreAuthorize("hasAnyRole('MY_ROLE_TO_CHECK')")

preAuthorize also allow you expressions with Spring EL.

if you just want to check, if the user is logged in, then it could be

@PreAuthorize("isAuthenticated()")

Take a look at Built-in EL of Spring Security

Enable annotation-based security to use preAuthorize