How to disable HTTP POST REQUEST of oData APIs?

Question

I'm setting up a new Java application using oData and ServletRegistrationBean. I'd like to disable the option of receiving POST request and to allow only GET requests.

Where should I set it up? Can I create kind of a whitelist/blacklist?

ServletRegistrationBean odataServRegstration = new ServletRegistrationBean(new CXFNonSpringJaxrsServlet(), "/odata/*");
Map<String, String> initParameters = new HashMap<>();
initParameters.put("javax.ws.rs.Application", "org.apache.olingo.odata2.core.rest.app.ODataApplication");
initParameters.put("org.apache.olingo.odata2.service.factory", "com.sap.context.JPAServiceFactory");
odataServRegstration.setInitParameters(initParameters);
return odataServRegstration;

Answer 1

In spring Security you can easily configure that for example only users of role admin are able to make non GetRequests. I will provide an example soon unless you find it on the net before that. Other unseres will receive a 403.

A minimalistic example would be:

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
          .csrf().disable()
          .authorizeRequests()
            .antMatchers(HttpMethod.POST, "/**").hasRole("ADMIN")
            .antMatchers("/**").hasAnyRole("ADMIN","USER")
          .and()
          .httpBasic()
        ;
    }

Pay attention to .antMatchers(HttpMethod.POST, "/**").hasRole("ADMIN").