Take the 2-minute tour ×

Consider the following object:

class User {
   Long userId
   String emailAddress;
   boolean isLocked;

If I implement an endpoint for the User resource, as follows:

public class UserController {

    public void updateUser(@PathVariable("userId") Long userId, User updatedUser)
        User dbUser = userRepository.find(userId)
        // map updatedUser to dbUser

Is there currently a standard way to expose the /user/{userId} endpoint, but restrict updates of specific fields based on user privileges?

E.g. I may wish to restrict updates to the isLocked property to users with ROLE_ADMIN, whilst still allowing the user to update their email address.

Note - this question doesn't pertain strictly to Spring HATEOS - I'm interested in any Spring standard solutions to this problem.

share|improve this question
add comment

1 Answer

Two possibilities comes to my mind:

  • validation (@Valid)
  • binder configuration (@InitBinder)

You can validate the incoming object and check for such changes. Or you can set-up WebDataBinder#setAllowedFields within your @InitBinder method based on user authorities. The latter one would be probably the easiest way. However instead of returning validation error your application will ignore the fields completely.

share|improve this answer
add comment

Your Answer


