I'm writing a pretty simple ecommerce app with spring boot and thymeleaf and I found out that users can see any order by changing the id in URL. For example: User placed an order with ID 5, so he can see his order on url: /order/details/5 But if the user changed url to f.e /order/details/4 he can see details of order that he shouldn't be able to see. Is there a simple way to block it with Spring security?

CodePudding user response：

First off, let's get some lingo out of the way:

Authentication - The act of proving someone's identity. E.g., you login with a username, but you need a password to prove that it's you.

Authorization - Is the act of granting a user permission to perform an action.

Those terms are important when reading the Spring Security Documentation. I assume that you already authenticate user and now you want to authorize them to view, e.g., their own orders, but not those of other users.

But I guess the orders are stored in a database. So you'll probably have to authenticate in your service layer. Meaning Spring Security takes care of authentication and you have the user available. When you fetch some order, you also need to make sure that the authenticated user is the owner.

Another thing to consider is using UUIDs as primary key. That makes it much harder to guess an ID but this is absolutely no replacement for authorization! Seriously. It is not. Security by obscurity is broken.