How to Secure a Spring Rest Service using Spring Aspect

Learn how to secure Spring REST endpoints using Aspect and without Spring Security.

1. Introduction

In this project, we introduce a security interceptor that pre-handles a REST request and where a bearer token is converted into an application user. An error will be thrown if the user does not exist or does not have the required permission. If the user is valid, its id is saved in the request attribute and can be passed into the REST endpoint for future use.

With this approach, you can build your user, role, and permission table without Spring Security.

2. The User Entity

We need to define the user, role, and permissions table below.

2.1 User table contains the user information we need for logging in.

2.2 Role, which is linked in the permission table.

2.3 UserRole is the bridge table between a user and a role.

We will need this information later when we intercept the request.

3. Roles and Permissions

We will define a role EmployeeManager with permissions list_employee, read_employee, update_employee, etc. But we will only assign the list_employee permission to our user.

4. User Holder

We need to define a POJO that will hold our current user.

package com.czetsuyatech.springaspect.web.security;

import java.util.Set;
import lombok.Data;

@Data
public class CurrentUser {

  private String username;
  private Set<String> permissions;
}

5. Security Aspect

Let's inspect the classes that secure our application.

Security interface with hasPermission method. As we can see, we use this interface to annotate our endpoints. It can be defined on a class level and inherited by its methods.

package com.czetsuyatech.springaspect.web.security;

import java.lang.annotation.ElementType;
import java.lang.annotation.Inherited;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Inherited
public @interface Security {

  String hasPermission();
}

SecurityInterceptor intercepts requests to our REST service and gets the bearer token from the HTTP headers. From the bearer token, we can get the external id which we can map to a local user stored in our database. Then we can get the permissions associated with this user.

package com.czetsuyatech.springaspect.web.security;

import java.util.Arrays;
import java.util.HashSet;
import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.web.servlet.HandlerInterceptor;

public class SecurityInterceptor implements HandlerInterceptor {

  private static final Pattern AUTH_HEADER_PATTERN = Pattern.compile("Bearer (\\S+)");

  @Override
  public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

    // get the bearer token
    //    String authorization = request.getHeader(HttpHeaders.AUTHORIZATION);
    //
    //    if (StringUtils.hasLength(authorization)) {
    //      throw new AccessDeniedException("Authorization header is empty");
    //    }
    //    Matcher matcher = AUTH_HEADER_PATTERN.matcher(authorization);
    //    if (!matcher.matches()) {
    //      throw new AccessDeniedException(String.format("Invalid authorization header: [%s]", authorization));
    //    }
    //    String accessToken = matcher.group(1);

    // get the user from the bearer token
    // Long userId = getUserIdByAccessToken(accessToken);

    CurrentUser currentUser = new CurrentUser();
    currentUser.setUsername("czetsuyatech.com");
    currentUser.setPermissions(new HashSet<>(Arrays.asList("list_employee")));

    // catch null user here

    // use for security
    UserThreadLocalHolder.set(currentUser);

    // use to fetch the user info
    request.setAttribute("currentUserId", 1L);

    return true;
  }
}

6. UserThreadLocalHolder

This is where we store the user data for the current thread, which we can access later in our aspect for authorization.

package com.czetsuyatech.springaspect.web.security;

public class UserThreadLocalHolder {

  private static ThreadLocal<CurrentUser> threadLocal = new ThreadLocal<>();

  public static void set(CurrentUser currentUser) {
    threadLocal.set(currentUser);
  }

  public static CurrentUser get() {
    return threadLocal.get();
  }

  public static void remove() {
    threadLocal.remove();
  }
}

7. SecurityAspect

This class is called in any method annotated with our Security interface and does authorization base on the authorization token and user data in our table.

package com.czetsuyatech.springaspect.web.security;

import com.czetsuyatech.springaspect.web.security.exception.UserDoesNotExistsException;
import com.czetsuyatech.springaspect.web.security.exception.UserNotAuthorizedException;
import org.aspectj.lang.JoinPoint;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Before;
import org.springframework.stereotype.Component;

@Aspect
@Component
public class SecurityAspect {

  @Before(
      value = "@annotation(security)",
      argNames = "joinPoint,security"
  )
  public void methodSecurity(
      JoinPoint joinPoint,
      Security security
  ) {
    authorize(joinPoint, security);
  }

  @Before(
      value = "@within(security)",
      argNames = "joinPoint,security"
  )
  public void classSecurity(
      JoinPoint joinPoint,
      Security security
  ) {
    authorize(joinPoint, security);
  }

  private void authorize(JoinPoint joinPoint, Security security) {

    CurrentUser currentUser = UserThreadLocalHolder.get();
    if (currentUser == null) {
      throw new UserDoesNotExistsException();

    } else if (currentUser.getPermissions() == null || !currentUser.getPermissions()
        .contains(security.hasPermission())) {
      throw new UserNotAuthorizedException(currentUser.getUsername(),
          joinPoint.getSignature().getName());
    }
  }
}

8. The Controller

We will define two endpoints, one with list_employee constraint and the second one with update_employee. Thus, we should get an error in the second.

package com.czetsuyatech.springaspect.web.controllers;

import com.czetsuyatech.springaspect.web.security.Security;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestAttribute;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/employees")
public class EmployeeController {

  @Security(hasPermission = "list_employee")
  @GetMapping
  public String getEmployees(@RequestAttribute Long currentUserId) {
    return String.format("currentUserId=%d", currentUserId);
  }

  @Security(hasPermission = "read_employee")
  @GetMapping("/{id}")
  public String getEmployee(@PathVariable String id, @RequestAttribute Long currentUserId) {
    return String.format("currentUserId=%d", currentUserId);
  }
}

9. Summary

In this blog, we learn how to secure our application using Spring Aspect and without Spring Security.

10. Disadvantages

This is a fundamental definition that fits a very particular use case. If you want more flexibility, I highly suggest using Spring Security.

11. Git Repository

The source code is available at https://github.com/czetsuya/spring-aspect-security.