Most efficient way to check if user is allowed to update an object
Soo ... I'm not quite sure how to formulate this without it sounding brash, but... Both of these methods are less than ideal...

Let's follow the behavioural flow to see what issues this code has:


The webservice portion you provide only understands PUT requests.
Conventionally, PUT requests are used to create objects, not to update them.
Instead one would expect a POST endpoint for that.
You first create an OK response and then overwrite it in case something fails.
That's somewhat... annoying in comparison to the simpler direct return.

try {
    db.updateLocation(token, ml);
    return Response.status(Status.OK).entity("location updated").build();
} catch (Exception e) {
    return Response.status(Status.BAD_REQUEST).entity(ex.getMessage()).build();
}

All this code assumes that the user gets to see the Exception message.
This is a bad assumption. Your webservice method should be responsible for creating useful messages, not your business logic. 
Considering that the webservice code does not compile (because the declaration for isUpdated is missing) I hope that you don't actually pretend that every Exception ever is the user's fault by throwing a HTTP 400 to them...


The root cause of your conundrum is that you're not using the power of widely used java sql abstractions. Instead of manually writing SQL statements and performing updates, you should really make use of JPA and Entities.

If you had these, all of this would boil down to the following simplified code:

private void updateLocation(String username, MapLocation update) {
    MapLocation stored = em.find(MapLocation.class, update.getLocationId());
    if (stored == null) {
        throw new LocationDoesNotExistException();
    }
    if (!stored.getUsername().equals(username)) {
        throw new IllegalLocationUpdateException();
    }
    em.persist(update);
}


Note that the codesample above makes some simplifying assumptions about transaction management and the class hierarchy of the Exceptions it throws.

Note that I'm suggesting to rewrite your webservice method to something like:

public Response update(String loginToken, MapLocation request) {
    final String username = getUsernameFromToken(loginToken);
    try {
        db.updateLocation(username, request);
        return Response.ok().build();
    } catch (LocationDoesNotExistException e) {
        return Response.status(Response.Status.NOT_FOUND).build();
    } catch (IllegalLocationUpdateException e) {
        return Response.status(Response.Status.FORBIDDEN).build();
    } catch (Exception e) {
        LOGGER.warn("Unexpected exception in updateLocation", e);
        return Response.serverError().build();
    }
}