From ffe7db80b440a659da3bf6f9c09987ace861bba9 Mon Sep 17 00:00:00 2001
From: Kamal Wickramanayake <kamal@inbox.lk>
Date: Fri, 3 Jul 2026 22:05:24 +0530
Subject: Prevent roles of all users being accessed via API gateway /bff/api/
 path

---
 .../resourceserver/config/SecurityConfig.java      |  2 +-
 .../security/AuthRestController.java               | 43 ++++++++++++++++++++++
 .../security/UserRestController.java               | 12 ------
 3 files changed, 44 insertions(+), 13 deletions(-)
 create mode 100644 microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java

(limited to 'microservices/03-resource-server/src/main')

diff --git a/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java b/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java
index 7102e69..bf9dbe5 100644
--- a/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java
+++ b/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java
@@ -18,7 +18,7 @@ public class SecurityConfig {
         http
             .authorizeHttpRequests(authorize -> authorize
                 // 1. Specify the URL to allow without restrictions
-                .requestMatchers("/api/security/users/*/roles", "/public/**").permitAll()
+                .requestMatchers("/security/open/users/*/roles", "/public/**").permitAll()
                 // 2. Require authentication for all other requests
                 .anyRequest().authenticated()
             )
diff --git a/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java
new file mode 100644
index 0000000..2c9b48a
--- /dev/null
+++ b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/AuthRestController.java
@@ -0,0 +1,43 @@
+package com.example.resourceserver.security;
+
+import java.util.Optional;
+import java.util.Set;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * This controller is a special one. The getRoles() method is accessed by calls from API gateway
+ * when someone logs in to the API gateway.
+ * 
+ * The path is publicly accessible. To prevent access via API gateway by API gateway clients, a different
+ * path is used (not start with /api).
+ * 
+ * SecurityConfig.java has been configured to allow access without authentication.
+ * 
+ * AuthRestController
+ */
+@RestController
+@RequestMapping("/security/open/users")
+public class AuthRestController {
+    private UserService userService;
+
+    public AuthRestController(UserService userService) {
+        this.userService = userService;
+    }
+
+    @GetMapping("/{username}/roles")
+    public ResponseEntity<RolesResponse> getRoles(@PathVariable String username) {
+        Optional<User> user = userService.findByUsername(username);
+
+        if (user.isEmpty()) {
+            return ResponseEntity.ok(new RolesResponse(Set.of()));
+        }
+
+        return ResponseEntity.ok(new RolesResponse(user.get().getRoles()));
+    }
+
+}
diff --git a/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java
index 0eb0d51..1b0598d 100644
--- a/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java
+++ b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java
@@ -13,7 +13,6 @@ import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestHeader;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
@@ -27,17 +26,6 @@ public class UserRestController {
         this.userService = userService;
     }
 
-    @GetMapping("/{username}/roles")
-    public ResponseEntity<RolesResponse> getRoles(@PathVariable String username) {
-        Optional<User> user = userService.findByUsername(username);
-
-        if (user.isEmpty()) {
-            return ResponseEntity.ok(new RolesResponse(Set.of()));
-        }
-
-        return ResponseEntity.ok(new RolesResponse(user.get().getRoles()));
-    }
-
     @GetMapping("/test")
     public String test(Principal principal) {
         return principal.toString();
-- 
cgit v1.2.3