Have Geek Brain

Spring Security: Guidance needed to manage GrantedAuthority

I have a problem when it comes to GrantedAuthority objects in a Spring Security application. I am looking for a good way to deal with things. First of all, I am trying to describe my concern, if there are any factual errors, feel free to point them out, I will only be grateful.

Spring Security uses GrantedAuthority instances to act as authorization tokens across different parts of the application.

By default, GrantedAuthority can represent itself as a String. When methods are secured with @Secured ("ROLE_NAME") or URLs are secured using Spring XML configuration or when a programmatic HttpServletRequest is validated programmatically as in if (request.isUserInRole ("ROLE_NAME")) {..} it is always a string which you use to specify the permissions that the checkbox is selected for.

I am wondering how to use static strings in multiple places in an application. If the role name is changed, the developer needs to hunt down all the old lines and update them. There will be no compile time error if String is omitted, only runtime problem.

What's the best way for you when it comes to GrantedAuthority objects in a Spring Security application? What are the pros and cons of your solution?

0


source to share


3 answers


First of all, if possible, perform your checks only in a specific place in the application (for example, the HTTP interceptor at the beginning of the request) and using only one of the approaches mentioned. This is a good practice as you will be able to know with authority when a user is logged in.



If this is not possible, use enumerations for the role names and only compare them with enumerations. So if you want to find all the apps in an app, this is a simple search.

+1


source


I don't see a big problem here. It is very unlikely for GrantedAuthority to change the key. Just don't name the roles ROLE_A.



Also, I personally prefer configuring XML security over annotations. In general, it is a good idea to keep any related configurations in one place.

0


source


Spring and other environments (especially dynamic languages) use the "Configuration Convention". If you could define the role names yourself, you will easily find that many more lines of code are required.

So stick to convention. Always use the following 3 roles: ROLE_ANONYMOUS, ROLE_ADMIN and ROLE_USER. If you need another, name it appropriately and use it in all cases. The documentation is important.

Unit testing is also imported. This helps you in cases where the error is not caught by the compiler.

-1


source






More articles:


All Articles