DELETE \/api\/users\/{id}<\/code> endpoint is also limited to ADMIN users, enabling them to delete a user by their ID.<\/li>\n<\/ul>\nThese endpoints demonstrate how to secure HTTP methods using Spring Security’s role-based authorization.<\/p>\n
2.1 Create a Controller<\/h3>\n
The controller exposes the APIs we want to secure.<\/p>\n
\npackage com.example.demo.controller;\n\nimport org.springframework.web.bind.annotation.*;\n\n@RestController\n@RequestMapping(\"\/api\/users\")\npublic class UserController {\n\n @GetMapping\n public String getUsers() {\n return \"Fetching all users\";\n }\n\n @PostMapping\n public String createUser() {\n return \"User created\";\n }\n\n @DeleteMapping(\"\/{id}\")\n public String deleteUser(@PathVariable String id) {\n return \"Deleted user with id: \" + id;\n }\n}\n<\/pre>\nThe UserController<\/code> class is annotated with @RestController<\/code>, indicating that it is a RESTful web controller where each method returns a response body directly. The base URL for all endpoints in this class is set to \/api\/users<\/code> using @RequestMapping<\/code>. The getUsers()<\/code> method is mapped to HTTP GET requests and returns a string indicating that all users are being fetched. The createUser()<\/code> method handles HTTP POST requests and returns a message confirming user creation. The deleteUser(String id)<\/code> method maps to HTTP DELETE requests with a dynamic path variable id<\/code> and returns a message stating that the user with the specified ID has been deleted.<\/p>\n2.2 Configure Spring Security<\/h3>\n
Now, let\u2019s define role-based access rules.<\/p>\n
\npackage com.example.demo.config;\n\nimport org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.security.config.annotation.web.builders.HttpSecurity;\nimport org.springframework.security.core.userdetails.User;\nimport org.springframework.security.core.userdetails.UserDetails;\nimport org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;\nimport org.springframework.security.crypto.password.PasswordEncoder;\nimport org.springframework.security.web.SecurityFilterChain;\n\n@Configuration\npublic class SecurityConfig {\n\n @Bean\n public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {\n http\n .csrf().disable()\n .authorizeHttpRequests(auth -> auth\n .requestMatchers(\"\/api\/users\").hasRole(\"ADMIN\")\n .requestMatchers(\"\/api\/users\/**\").hasRole(\"ADMIN\")\n .requestMatchers(\"\/api\/users\", org.springframework.http.HttpMethod.GET.name()).hasAnyRole(\"ADMIN\", \"USER\")\n .anyRequest().authenticated()\n )\n .httpBasic();\n\n return http.build();\n }\n\n @Bean\n public PasswordEncoder passwordEncoder() {\n return new BCryptPasswordEncoder();\n }\n\n @Bean\n public org.springframework.security.core.userdetails.UserDetailsService users() {\n UserDetails user = User.builder()\n .username(\"user\")\n .password(passwordEncoder().encode(\"user123\"))\n .roles(\"USER\")\n .build();\n\n UserDetails admin = User.builder()\n .username(\"admin\")\n .password(passwordEncoder().encode(\"admin123\"))\n .roles(\"ADMIN\")\n .build();\n\n return new org.springframework.security.provisioning.InMemoryUserDetailsManager(user, admin);\n }\n}\n<\/pre>\nThe SecurityConfig<\/code> class is annotated with @Configuration<\/code>, indicating that it defines Spring Security-related configuration. The filterChain(HttpSecurity http)<\/code> method configures the security filter chain. It disables CSRF protection for simplicity, then sets up authorization rules: only users with the ADMIN role can access \/api\/users<\/code> and \/api\/users\/**<\/code> for operations like POST or DELETE, while both ADMIN and USER roles are allowed to perform GET requests on \/api\/users<\/code>. Any other request must be authenticated. The configuration also enables HTTP Basic authentication for login prompts via browser or tools like curl\/Postman. The passwordEncoder()<\/code> method defines a BCryptPasswordEncoder<\/code> bean to securely hash passwords. The users()<\/code> method sets up an in-memory user store with two users: one with the USER role and one with the ADMIN role, both having their passwords encoded using BCrypt. This setup is ideal for simple demos or testing environments.<\/p>\n2.3 Main Application Class<\/h3>\n
Now let\u2019s add the main class to bootstrap the Spring Boot application.<\/p>\n
\npackage com.example.demo;\n\nimport org.springframework.boot.SpringApplication;\nimport org.springframework.boot.autoconfigure.SpringBootApplication;\n\n@SpringBootApplication\npublic class DemoApplication {\n public static void main(String[] args) {\n SpringApplication.run(DemoApplication.class, args);\n }\n}\n<\/pre>\nThe DemoApplication<\/code> class is annotated with @SpringBootApplication<\/code>, which combines @Configuration<\/code>, @EnableAutoConfiguration<\/code>, and @ComponentScan<\/code>. This serves as the entry point of the Spring Boot application. The main<\/code> method uses SpringApplication.run()<\/code> to launch the application.<\/p>\n2.4 How to Run the Application<\/h3>\n
To run the Spring Boot application, follow these steps:<\/p>\n
\n- Ensure you have Java 17+ and Maven installed on your system.<\/li>\n
- Open a terminal and navigate to the project directory.<\/li>\n
- Run
mvn clean install<\/code> to build the project.<\/li>\n- Then run
mvn spring-boot:run<\/code> to start the application.<\/li>\n- By default, the server will start at
http:\/\/localhost:8080<\/code>.<\/li>\n<\/ul>\n2.4.1 Demo<\/h4>\n
You can now use Postman or curl to make authenticated HTTP requests to \/api\/users<\/code> and verify access control as per the configured roles.<\/p>\n\n- GET \/api\/users using credentials
user:user123<\/code> : Allowed: Returns 200 OK (access granted to USER role)<\/li>\n- POST \/api\/users using credentials
user:user123<\/code> : Denied: Returns 403 Forbidden (USER role not permitted)<\/li>\n- POST \/api\/users using credentials
admin:admin123<\/code> : Allowed: Returns 200 OK (ADMIN role has access)<\/li>\n- DELETE \/api\/users\/1 using credentials
admin:admin123<\/code> : Allowed: Returns 200 OK (ADMIN role permitted to delete)<\/li>\n- DELETE \/api\/users\/1 using credentials
user:user123<\/code> : Denied: Returns 403 Forbidden (USER role not authorized)<\/li>\n<\/ul>\nThese test cases confirm that Spring Security is enforcing both role and HTTP method-based access control.<\/p>\n