This post looks at 4 ways to control access to Spring Data REST using RepositoryDetectionStrategies’s
This post forms part of a series looking at Spring Data REST –
You can control access to Spring Data REST using the 4 RepositoryDetectionStrategies –
ALL
Exposes all Spring Data Repositories regardless of annotations or access control
ANNOTATED
Only Repositories exposed with RepositoryRestResource or RestResource, and the exported flag is not set to false.
DEFAULT
public Spring Data Repositories or ones annotated with RepositoryRestResource
VISIBILITY
Only public Spring Data Repositories
You can run the examples by –
mvnw spring-boot:run
Ive created a Spring Rest Configuration class for this example –
@Component public class SpringRestConfiguration extends RepositoryRestConfigurerAdapter { @Override public void configureRepositoryRestConfiguration(RepositoryRestConfiguration config) { config.setRepositoryDetectionStrategy(RepositoryDetectionStrategy.RepositoryDetectionStrategies.DEFAULT); } }
All of the examples will be changing the enumerated value of RepositoryDetectionStrategy.RepositoryDetectionStrategies, and testing what REST end points are exposed.
I have also annoted one of our Spring Data Repositories –
@RepositoryRestResource @PreAuthorize("hasRole('ROLE_USER')") public interface ParkrunCourseRepository extends CrudRepository<ParkrunCourse, Long> { @Override @PreAuthorize("hasRole('ROLE_ADMIN')") ParkrunCourse save(ParkrunCourse parkrunCourse); }
A default setting RepositoryDetectionStrategy detect –
So with our example we would expect to see both interfaces exposed as REST end points
We can confirm this by calling http://localhost:8080/rest/profile –
curl -u user:user -X GET http://localhost:8080/rest/profile { "_links" : { "self" : { "href" : "http://localhost:8080/rest/profile" }, "secrets" : { "href" : "http://localhost:8080/rest/profile/secrets" }, "parkrunCourses" : { "href" : "http://localhost:8080/rest/profile/parkrunCourses" } } }
Annotated will only detect interfaces annotated with RepositoryRestResource or RestResource, and an exported flag that is true(default). In our test case we would only expect to see the end point for ParkrunCourseRepository to be exposed as it is annotated with @RepositoryRestResource
We can test and confirm this –
curl -u user:user -X GET http://localhost:8080/rest/profile { "_links" : { "self" : { "href" : "http://localhost:8080/rest/profile" }, "parkrunCourses" : { "href" : "http://localhost:8080/rest/profile/parkrunCourses" } } }
VISIBILITY will only detect REST and expose reportories based if they are publicly exposed.
Lets make a change to SecretRepository to leave the interface with default visibility –
interface SecretRepository extends CrudRepository<Secret, Long> { }
We would not expect to see this end point, and would only expect to see the ParkrunCourseRepository end point. This is confirmed when we call the rest/profile –
curl -u user:user -X GET http://localhost:8080/rest/profile { "_links" : { "self" : { "href" : "http://localhost:8080/rest/profile" }, "parkrunCourses" : { "href" : "http://localhost:8080/rest/profile/parkrunCourses" } } }
Finally if we use RepositoriesDetectionStrategies.ALL with SecretRepository at default access. Then we would expect to see both the parkrunCourses and Secret’s end point. All will also expose end points that have an exported false attribute.
Restart the server and test –
curl -u user:user -X GET http://localhost:8080/rest/profile { "_links" : { "self" : { "href" : "http://localhost:8080/rest/profile" }, "parkrunCourses" : { "href" : "http://localhost:8080/rest/profile/parkrunCourses" }, "secrets" : { "href" : "http://localhost:8080/rest/profile/secrets" } } }
This post looked at 4 ways to control access to Spring Data REST using RepositoryDetectionStrategies allow or restrict access to the underlying Spring Data JPA repositories. The options are – ALL, ANNOTATED, VISIBILITY or DEFAULT