Cfrgtkky

I created a web application using a sample project in GitHub. However, it required authentication for all crud operations. I want to restrict this security checking for all read DB operations. What changes do I need?

These are the related classes:

protected void configure(HttpSecurity http) throws Exception {

        http

                .cors()

                    .and()

                .csrf()

                    .disable()

                .exceptionHandling()

                    .authenticationEntryPoint(unauthorizedHandler)

                    .and()

                .sessionManagement()

                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)

                    .and()

                .authorizeRequests()

                    .antMatchers("/",

                        "/favicon.ico",

                        "/**/*.png",

                        "/**/*.gif",

                        "/**/*.svg",

                        "/**/*.jpg",

                        "/**/*.html",

                        "/**/*.css",

                        "/**/*.js")

                        .permitAll()

                    .antMatchers("/api/auth/**")

                        .permitAll()

                    .antMatchers("/api/user/checkUsernameAvailability", "/api/user/checkEmailAvailability")

                        .permitAll()

                    .antMatchers(HttpMethod.GET, "/api/polls/**", "/api/users/**")

                        .permitAll()

                    .anyRequest()

                        .authenticated();



        // Add our custom JWT security filter

        http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);



    }

}

As far as i know there is no way to magically create a read only user.However, you can create a role such as ROLE_UPDATE and make all of your methods that perform creates/updates/deletes be secured via @Secured("ROLE_UPDATE"). Then, if a user is not granted the ROLE_UPDATE authority, they will not be able to call any of the 'writing' methods, and therefore it will be restricted to only call 'read' methods.

Generally, Spring Security doesn't have such feature. You can do as @Alien suggested create some role (ex. ROLE_WRITE and then check on the resources if the user who is trying to access the resource has the correct role

@PreAuthorize("hasRole('ROLE_WRITE')")

public String someWriteOperation() {

}

The other way (but it's only applying when your JPA framework allows you such feature) it's create a Filter in spring and then before processing your request further in the chain create transaction read-only:

@Component

@Order(1)

public class TransactionFilter implements Filter {



    @Override

    public void doFilterServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {



        //Create read only transaction  

        // ex. if(isUserReadOnly(Security ....getUser())) {DBSession.setReadOnly(true);}

        //Remember it will work only if your JPA framework have the feature - explore your code/framework before



        chain.doFilter(request, response);

    }

}

Remember filter order should be after Spring Security Filter