[Episode 57] Restricting User Access to Their Own Data
🔗 Hogwarts Artifacts Online user stories: https://xmind.app/m/999Pse
🔗 GitHub repository: https://github.com/Washingtonwei/hogw...
Related Videos on Spring Security Authentication:
34 Introduction to Spring Security 🔗 • [Episode 34] Introduction to Spring Security
35 Implementing HTTP Basic Authentication in Spring Boot 🔗 • [Episode 35] Implementing HTTP Basic Authe...
37 Generating JWTs in Spring Boot 🔗 • [Episode 37] Generating JWTs in Spring Boot
In this video, we explored how to restrict user access to their own data by implementing custom authorization rules with Spring Security’s AuthorizationManager. This approach ensures user-specific data access and prevents the so-called "Horizontal Privilege Escalation". By the end of this video, you’ll be able to apply it to your own authorization scenarios.
00:00 Introduction
07:42 The Authentication Interface
09:07 The Authentication Process in Hogwarts Artifacts Online
16:40 Adding userId as a Jwt Claim
19:41 Implementing a Custom Authorization Manager
34:03 Testing in Postman
35:24 Writing Integration Test Cases
43:48 Fixing Role-based User Info Update
56:22 Conclusion
This video belongs to a playlist "Learn Spring Boot 3 with Bingyang": • Learn Spring Boot 3 with Bingyang
I don't want to make a super long video so I split it into smaller ones. If you want to learn Spring Boot 3 systematically, please visit the playlist (and save the playlist) for more Spring Boot 3 tutorials.
Feel free to leave a comment if you have any questions.
As always, thanks for watching, and happy learning!