Full Stack Development with JHipster - Second Edition

Limiting access to entities

First, let's limit the access for normal users. This can be done easily at the API level using Spring Security. Add the following snippet to the configure method of src/main/java/com/mycompany/store/config/SecurityConfiguration.java.

Add it right before the line .antMatchers("/api/**").authenticated(). The position is very important:

.antMatchers("/api/customers").hasAuthority(AuthoritiesConstants.ADMIN).antMatchers("/api/product-categories").hasAuthority(AuthoritiesConstants.ADMIN)

We specify that when the request path matches api/customers or api/product-categories, the user should have ROLE_ADMIN to access them. Now recompile with ./gradlew compileJava, then sign out and log in as user and try to access the ...