diff --git a/docs/docs/index.html b/docs/docs/index.html index 5ab1042..f56c1a5 100644 --- a/docs/docs/index.html +++ b/docs/docs/index.html @@ -359,7 +359,7 @@ public class Payment { ... }

4. Security

SnapAdmin does not implement authentication and/or authorization mechanisms. However, you can use a standard Spring Security configuration in order to limit access to the web UI or specific parts of it.

-

All SnapAdmin routes start with the value of snapadmin.baseUrl property, and all write operations (edit, create, delete) are implemented as POST calls. The following code provides an example security configuration (assuming SnapAdmin runs at /admin):

+

All SnapAdmin routes start with the value of snapadmin.baseUrl property, and all write operations (edit, create, delete) are implemented as POST calls. The following code provides an example security configuration thatyou can further customize:

@@ -406,7 +406,33 @@ SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
     .build();
 }
-

You can look at the SnapAdmin auth test project to see the full implementation and use it as a blueprint for your own projects.

+

Authorization

+

+ If your authentication related classes (e.g. User and Role) are managed by SnapAdmin it might be possible to edit them, depending on your security configuration. + This means that it might be possible for a USER to edit their own roles and escalate their privileges to ADMIN. +To setup things correctly so that this can't happen you have a few options:

+ +
Exclude auth-related classes from SnapAdmin
+

If you don't want these classes to be accessible at all from the UI, the best option is to just place them in a package that's not managed by SnapAdmin. Alternatively, if changing the package structure is not an option, you can apply them the @Disable annotation to obtain an equivalent result.

+ +
Adapt SecurityConfiguration
+ +

If you want these classes to be accessible from SnapAdmin securely, you need to change your security configuration so that write operations on these tables can only be performed by users with the right privileges. + +For example, you can add something like this to your security configuration: + +

.requestMatchers(
+    AntPathRequestMatcher.antMatcher("/" + baseUrl + "/model/tech.ailef.snapadmin.auth.models.User")
+).hasAuthority("ADMIN")
+.requestMatchers(
+    AntPathRequestMatcher.antMatcher("/" + baseUrl + "/model/tech.ailef.snapadmin.auth.models.Role")
+).hasAuthority("ADMIN")
+
+ +

+ With this configuration, only ADMIN users are allowed to access the SnapAdmin routes for the protected tables. As always, you can customize this further to your needs as long as you follow these guidelines. + +You can look at the SnapAdmin auth test project to see a full implementation and use it as a blueprint for your own projects.

5. Troubleshooting