title: Ensure a particular user can only see their own user details - Using Spring
body: <p>Working with Spring / Spring security on a small project at the moment and having difficulty implementing this feature.  Ideally I only want user1 to view the details of user1 and not those of 2,3 or 4 for example.</p>
  
  <p>I've implemented Spring Security with Roles and understand that I can retrieve a UserDetails object or a principle, I'm not sure exactly but I know I can retrieve the details of the current logged in user using one of, what appears to be many methods.</p>
  
  <p>This is what I'm currently using as a proof of concept when we go to the Admin/home page:</p>
  
  <pre><code>Authentication auth = SecurityContextHolder.getContext().getAuthentication();
      Gamer gamer = gamerService.findGamerByEmail(auth.getName());
  
      System.out.println("Auth: " + auth.getName());
      System.out.println("Gamer: " + gamer.getName() + gamer.getId() + gamer.getEmail());
  </code></pre>
  
  <p>The security config takes care of whether or not the current user can access because of the roles assigned to it.  </p>
  
  <p>I believe I should be able to go to the url of <code>/mysite/viewUserDetails</code> and have that page display information of the current user but I cannot find any examples of this, I've found plenty of example that prove a logged in user can view a page but none that specify checks in place to ensure user1 can only view user1's details.</p>
  
  <p>On an older page I do this to display information for a particular user but I understand this to be bad practice-</p>
  
  <pre><code>&lt;a th:href="@{/gamer/{gamerid}/games/excited (gamerid=${gamer.id}) }"&gt;
  </code></pre>
  
  <p>*Worth noting that this isn't using any form of login/registration to pull out this info, I'm simple using the id I pass in as part of the DB query.</p>
  
  <p>It maps onto :</p>
  
  <pre><code>   @RequestMapping("/gamer/{gamerid}/games/excited")
  public String getExcited(@PathVariable final Long gamerid, Model model){
  
      addGamerListAttributes(model, gamerid, "EXC");
      return "games";
  }
  </code></pre>
  
  <p>So my question becomes, and I hope you can point in the right direction, How can I implement a solution where a user can only view his/her details and how should this be represented via the form and connecting controllers as passing ids in the url is kinda ugly (I could use a guid but...)</p>
  
  <p>Thanks so much in advance.</p>