springspring-bootspring-securityspring-expression-language

Using a request header value in @PreAuthorize

Is it possible to use a request header value in @PreAuthorize?

In my app, all requests have a custom header included which I need to use in conjunction with the user role to determine whether or not they should be allowed to access the controller.

It's ok if someone manually specifies a header as that won't be a security issue, as ultimately the role will control this. But I will need to use it to cut down on checking for that manually in each controller method.

Thank you, Matt

Solution

  • 1 - This may be the fastest method if you will only use it in a few places.

    @GetMapping(value = "/private-api-method")
@PreAuthorize("#request.getHeader('header-name') == 'localhost:8080'")
public ResponseEntity<String> privateApiMethod(HttpServletRequest request) {
    return ResponseEntity.ok("OK!");
}

    OR

    @GetMapping(value = "/private-api-method")
@PreAuthorize("#header == 'localhost:8080'")
public ResponseEntity<String> privateApiMethod(@RequestHeader("header-name") String header) {
    return ResponseEntity.ok("OK!");
}

    2 - This may be the best method if you will use it in many places.

    (In the SecurityService, you can add multiple different methods of checking.)

    @GetMapping(value = "/private-api-method")
@PreAuthorize("@securityService.checkHeader(#request)")
public ResponseEntity<String> privateApiMethod(HttpServletRequest request) {
    return ResponseEntity.ok("OK!");
}

    3 - You can choose a special method for yourself

    A Custom Security Expression with Spring Security