在jhipster中通过id限制URL访问控制

Question

I have a problem that each user can retrieve other users data from URL.

For instance, I have a rest api like this:

@GetMapping("/getFindByPersonId/{perId}")
@Timed
public List<ComboVahedAmoozeshi> getFindBySkhsIdCombo(@PathVariable Long perId){
    return comboVahedAmoozeshiRepository.getFindBySkhsIdCombo(perId);
}

After authorization, each user can change id and get other users data like the image below:

Is there any suggestion to restrict each user to don`t have access to call the method? Or Jhipster have any options to use UUId to hide id?

Answer 1

Thanks from @atomferede for the right answer. I have to add jhi_user_id in other entities and used @postfilter annotation to limit user's access to data. Although, maybe it`sa good idea to have this option in jhipster generator to enhance the security level and faster implementation.