JHipster implements several best practices for authentication and authorization. Mainly described here: https://www.jhipster.tech/security/. But I still do not see an example how to design a solution, which does not involve putting user verification logic all over the place for a very common use case.
Let's say you have a WebPage using REST-API like BankAccountResource from JHipster Sample App and you want to restrict this to only ADMIN role or currently logged in User. Let's say you have 50 of such services for your customers: BankAccount, Address, BillingAddress, UserData, Devices... For every resource a GET and UPDATE must be restricted. Also loading device /api/device/{id} might not include user-id.
- How do I prevent UserA from loading UserB's device by guessing it's id?
- How do I avoid planting that code in every method?
- I guess JHipster/SpringSecurity has concept/objects to handle such use cases. Could you point me, explain how to use them please?