Our Messages App is a simplified demo application. It doesn't have many features that a typical web application should have. For example, it lacks security checking. Currently, we allow anyone to post messages via the /messages (POST) API. A simple fix is to add security check logic inside the API handler, the MessageController.saveMessage() method, as follows:
public ResponseEntity<Message> saveMessage(@RequestBody MessageData data) {
checkSecurity();
...
}
private void checkSecurity() throws NotAuthorizedException {
// Do security checking
...
}
Inside the saveMessage() method, we invoke the checkSecurity() method immediately and, if the request is not authorized, NotAuthorizedException will be thrown.
Our Messages App doesn't have a user system. Hence, we cannot check whether a request is from an authenticated user. However...
