Class 17: Authorizing Users to View Secured Content

Agenda

• Announcements
• Code review
• Daily Systems: man pages
• Lecture
  • Thymeleaf fragments & templating
  • Adding a model
  • Authorization
• Lab intro

Learning Objectives

• Students will be able to allows users to log in to their accounts, authenticated with Spring Auth.
• Students will be able to use Spring Auth to authorize or restrict users from seeing other users's private data.
• Students will be able to draw a distinction between a user being authenticated (logged in) and being authorized (allowed) to view/modify content.

Lecture Outline

• Define the four components of what type of resources need to be protected with Auth:
  • Routes - unauthorized users shouldn't be able to access some pages at all.
  • UI - unauthorized users shouldn't see UI like an edit button they don't have permissions to touch unless they were an administrator or owner.
  • Actions - unauthorized users shouldn't be able to perform actions on API endpoints.
  • Server Logic - our application should be able to programmatically determine if a user has authorization to perform certain actions, and execute accordingly.