Spring security user based permission? (not role based)

Question

Assume I have a database composed of user and projects. A user has a one to many relationship with projects. The user can do operations using rest endpoints.

The problem is: how can I verify that this user owns this resource?

I don't want a malicious user to change an id then suddenly he views another person's project details/images/etc. Think of it like a social media (my app is not a social media but trying to illustrate the issue): where you can view only your images but not another person's images despite having the same "status".

Most spring-security blogs online is using a role based approach. I have no idea what to even search for in this case (tried multiple search queries to no avail).

One option is to run some sort of multijoin query on every resource request/operation till I reach that resource id and check it's owning user to check if it is the logged in user. However, I am not sure if this way is efficient since there are multiple tables in a chain in the real app (could have a lot of joins if I go this way manually; example: user -> project -> tasklist->... -> Note; deleting a note would trigger a large chain) or how to make the "authorizer" use it.

what are my options?

In case it matters: I am using spring-boot + hibernate/JPA + spring-security

Answer 1

Spring Security has the following concepts:

Authentication:

Proving the an actor is who it vouches to be. Authentication is done using credentials , where credentials can take any number of forms - username/password, token, hardware key, etc.

You can set up Spring Security with a set of acceptable authentication providers.

Authorization:

Given an authenticated user, deciding if that user has access to a given resource. Where the resource can be:

• An HTTP endpoint.
• An Java Method.
• A property of an object.

What you want to do here is provide a custom authorization scheme.

You can read about Spring Security's authorization architecture here , including how to set up custom authorization. Once you're ready you might ask specific questions as you go.