title: Authentication and authorization in Spring Data REST
body: <p>I am implementing a <a href="http://projects.spring.io/spring-data-rest/">Spring Data REST</a> based app and I would like to know if there is an elegant way to implement authentication and authorization rules using this framework or related frameworks. </p>
  
  <p>All HTTP requests to the REST server must carry authentication headers, I need to check them and decide to authorize or not based on the HTTP method and the association of the authenticated user with the resource being requested. For example, (the app is the REST server of an e-learning system), the instructors can access only their own course sections, students can access only the courses sections they are subscribed, etc.</p>
  
  <p>I would like to know if there is a default way to implement authorization in Spring Data REST. If the answer is no, could you make a suggestion for my issue? I am thinking about:</p>
  
  <ul>
  <li>Servlet Filters</li>
  <li>Spring Security</li>
  <li>Spring Data REST Handlers (how to access the HTTP headers?)</li>
  </ul>