title: How to configure Spring-Data-Rest in way to only return data owned by the logged in user
body: <p>I am working on a Spring Boot RESTful application which will be exposing a bunch of APIs for the web app to perform CRUD operations on the resources.</p>
  
  <p>I am using <code>spring-data-rest</code> (along with <code>spring-data-jpa</code> of course) to expose the entities/repositories with the help of <em>Spring Magic</em>.</p>
  
  <p>Even though I have secured (role-based) the endpoints with spring-security, it is not completely secure.</p>
  
  <p><strong>For example:</strong>
  I have a <code>User</code> entity with has <code>one-to-many</code> relationship with <code>Car</code>. So the endpoint (auto exposed by <code>spring-data-rest</code>) for getting a user's cars is <a href="http://localhost:8080/users/%7BuserId%7D/cars" rel="nofollow noreferrer">localhost:8080/users/{userId}/cars</a></p>
  
  <p>However, any user with the required role can just pass the <code>userId</code> of another user and still access the endpoint.
  The behavior I want is to secure these endpoints in a way that if I a logged-in user's ID is <code>1</code>, then we can only hit <a href="http://localhost:8080/users/1/cars" rel="nofollow noreferrer">localhost:8080/users/1/cars</a>. Any other request with any other <code>userId</code> should end up in <strong><code>403</code></strong> or something.</p>
  
  <p><strong>Note:</strong> I know if write my own controllers then I can get a handle of the principal and do what I desire. I just want to know is there a way or pattern in <code>spring-data-rest</code> to achieve this?</p>