From ffe7db80b440a659da3bf6f9c09987ace861bba9 Mon Sep 17 00:00:00 2001 From: Kamal Wickramanayake Date: Fri, 3 Jul 2026 22:05:24 +0530 Subject: Prevent roles of all users being accessed via API gateway /bff/api/ path --- .../example/resourceserver/security/UserRestController.java | 12 ------------ 1 file changed, 12 deletions(-) (limited to 'microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java') diff --git a/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java index 0eb0d51..1b0598d 100644 --- a/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java +++ b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java @@ -13,7 +13,6 @@ import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.security.oauth2.jwt.Jwt; import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PathVariable; import org.springframework.web.bind.annotation.RequestHeader; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RestController; @@ -27,17 +26,6 @@ public class UserRestController { this.userService = userService; } - @GetMapping("/{username}/roles") - public ResponseEntity getRoles(@PathVariable String username) { - Optional user = userService.findByUsername(username); - - if (user.isEmpty()) { - return ResponseEntity.ok(new RolesResponse(Set.of())); - } - - return ResponseEntity.ok(new RolesResponse(user.get().getRoles())); - } - @GetMapping("/test") public String test(Principal principal) { return principal.toString(); -- cgit v1.2.3