My web application at the moment accepts REST requests and handled via some controllers, which calls corresponding services to perform the logic.
Now I want to add in some security logic before calling the services. This includes checking if a service can be accessed ALSO amend the request body if necessary. I am having trouble on deciding where and how this security layer should be added.
Solution 1 is to create secured versions for each of the services, wrapping the original service and replace them in each of the controllers. Expose the secured services only and make the original services private/package protected. This way all my services remain separated in their own modules and security is enforced. But I may as well just update the services, without having an extra layer?
Solution 2 is to create one single Security service and takes in service requests from controllers, does the security checks, amends the request body, then dispatch the updated requests to corresponding services. This way I can have just one security module and security is enforced but this module has to know each of the services in order to dispatch to correct services.
Solution 3 is to create one single Security service and let the corresponding controllers to use it at will. In other words, individual controller handles some of the security logic. e.g. a controller calls security check, then passes in request body to get the amended request before calling the service. This way I can have just one security module and this module does not need to know each of the services, but it is not protecting any services and acting just like an utility class. i.e. there is no enforcing that new controller must go through this security logic.
Is there a solution that can enforce security, remain in its own module and no dependency to existing services?