authorization based on HTTP method

[fractal76]

Hi,
I am building an application based heavily on REST principles: we use http methods for CRUD operations.

This means that given a url http://somesite.com/contacts to:

• Create contact send a POST request with user info to the above url
• Delete contact send a DELETE request to http://somesite.com/contacts/3456, where 3456 is ID of contact.
• To get a user send GET request to url from delete example

While reading up on acegi I remember coming across a snippet saying that acegi url filters can accomodate HTTP methods for authorization. So, I would be able to say that only ROLE_ADMIN can submit HTTP DELETE request for a contact.

Servlet spec supports filtering of http-method through <security-constraint> see page 96 of the 2.4 servlet api specification available from sun. Since Servlet api appears to be separate from the acegi security filtering I assume there is some other mechanism for connecting method to authorization in some acegi configuration.

[Ben Alex]

Acegi Security does not presently offer this capability.

However, it shouldn't be too difficult to add. You'd basically be looking at a custom FilterInvocationDefinitionSource (see http://acegisecurity.sourceforge.net...ionSource.html), or modifying one of the existing implementations. As noted in the JavaDocs, FilterInvocationDefinitionSource operates with the FilterInvocation secure object, which in turn provides the HttpServletRequest and therefore can take into account the HTTP method as well as the URI pattern.

Your main decision is how to represent the new FilterInvocationDefinitionSource syntax at a property editor level. A suggestion is below:

/foo/bar.html:POST,DELETE=ROLE_FOO     (for GET or POST HTTP methods)
/secure/*:GET=ROLE_BAR                 (only for GET HTTP method)
/account/something=ROLE_BAR            (implies all HTTP methods)

If you'd like to implement this with the existing classes, I would be pleased to add it to CVS. I expect the AbstractFilterInvocationDefinitionSource.lookupAtt ributes() abstract method would need to change to allow the HTTP method to be passed to the subclass.