I am working on spring boot application. Authorization of rest calls is something that is task common for all requests in the project - there might be a few groups but not that many. Therefore I think it's a good idea to move it to some sort of interceptors to avoid code duplication and/or to not forget to check for access rights.

In my project I have the endpoint that in a basic scenario requires pretty basic access rights. However, based on some conditions the business logic requires to take an extra step that is an endpoint on its own and requires elevated privileges. I am tempted to just call the endpoint from my own service.

Just to clarify - I know that in normal scenario I could just abstrace the code of this "subendpoint" to a function and call it directly. However if I want this authorization check which we achieve via interceptors to be triggered I think there is no other way than to do a self-rest-call. Or maybe I'm wrong and there is a method in SpringBoot to call all the pre-controller checks without actually issuing an http call?

  • 2
    From a general software engineering point of view: it is definitely "ok" in case there is no clearly simpler method to achieve the same. But concerning SpringBoot: if there is a simpler method of calling the endpoint within that framework is a specific programming question which should be asked on Stackoverflow.
    – Doc Brown
    Jun 15 at 21:11
  • ’based on some conditions the business logic requires to take an extra step’. Is this decision based on conditions of the request? For example is there a Boolean in the request that triggers this behavior?
    – Rik D
    Jun 16 at 4:55
  • @RikD This is based on both parameters of the request and the state of the data in the database. You request a change on the resource and if the current state in the database meets some conditions there is extra step involved that requires elevated privilages
    – Marcin K.
    Jun 16 at 8:49
  • @DocBrown Thanks for your answer. For the SpringBoot part - my main concern was the self-rest-call and I only when writing the question I realised that there might be a way in SpringBoot rest handling routines that involves all the checks. Do you think I should edit the question?
    – Marcin K.
    Jun 16 at 8:52
  • @MarcinK.: I recommend you should do some more research before asking a question here. This question here maybe seen as a duplicate - if you think that case does not fit to your situation, because in SpringBoot the situation is differently, explain why,
    – Doc Brown
    Jun 16 at 10:07


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.