title: Spring Security - Ownership based access
body: <p>Let's say I've a minimal RESTful controller like the following, by the way using Java 8 and Spring Boot 2, ...</p>
  
  <pre><code>@RestController
  class MyController {
  
      @Autowired
      private PostService service;    
  
      @GetMapping
      public Post get() {
  
          return service.getLatest();
      }
  }
  </code></pre>
  
  <p>I've secured this route successfully using the Spring Security module. Now I want to allow only the resource owner access to this resource. With resource owner I mean the creator or saying it simple:</p>
  
  <pre><code>Post myPost = new Post();
  ...
  myPost.getCreator().equals(currentUser); // Should be true when access is granted
  </code></pre>
  
  <p>I found a lot about role based access, but nearly nothing for checking ownership... Of course I could place an if statement inside of the controller and throw an exception, but I intended to use something like Spring's <em>Expression-Based Access Control</em>.</p>
  
  <p>Any other ideas? Does somebody have a good idea or example for ownership checking of a resource?</p>