I want to create a secure link wiht java (Spring)

[u/Used_Glass2767]

Hello, I need to create a secure link to send to a user, but I am unsure how to implement this or what terminology to use for my research. Could someone provide recommendations, tools, or specific concepts I should look into?

[u/AutoModerator]

Moderator Announcement Read More »

Please ensure that:

• Your code is properly formatted as code block - see the sidebar (About on mobile) for instructions

• You include any and all error messages in full

• You ask clear questions

• You demonstrate effort in solving your question/problem - plain posting your assignments is forbidden (and such posts will be removed) as is asking for or giving solutions.

  Trying to solve problems on your own is a very important skill. Also, see Learn to help yourself in the sidebar

If any of the above points is not met, your post can and will be removed without further warning.

Code is to be formatted as code block (old reddit: empty line before the code, each code line indented by 4 spaces, new reddit: https://i.imgur.com/EJ7tqek.png) or linked via an external code hoster, like pastebin.com, github gist, github, bitbucket, gitlab, etc.

Please, do not use triple backticks (```) as they will only render properly on new reddit, not on old reddit.

Code blocks look like this:

public class HelloWorld {

    public static void main(String[] args) {
        System.out.println("Hello World!");
    }
}

You do not need to repost unless your post has been removed by a moderator. Just use the edit function of reddit to make sure your post complies with the above.

If your post has remained in violation of these rules for a prolonged period of time (at least an hour), a moderator may remove it at their discretion. In this case, they will comment with an explanation on why it has been removed, and you will be required to resubmit the entire post following the proper procedures.

To potential helpers

Please, do not help if any of the above points are not met, rather report the post. We are trying to improve the quality of posts here. In helping people who can't be bothered to comply with the above points, you are doing the community a disservice.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/bikeram]

You need to get up to speed with spring security (this could take a month without AI)

Basically everything that isn’t public is protected.

Then you can create a get endpoint /user/{userRandomUUID} where that uuid is pulled from the database referencing whatever you want.

You’ll want per user protection and admins automatically get a grant too (probably)

[u/Plenty-Evidence3147]

what exactly does the link need to do

[u/Far-Bullfrog161]

The usual terms to search for are "magic link", "one-time token" or "signed URL", and it works the same way as a password reset link. Generate a long random token with SecureRandom (32 bytes, Base64 URL-encoded), store only a hash of it in your database along with the user or resource it belongs to, an expiry time and a used flag, and put the raw token in the link. When the link is opened, hash the incoming token, look it up, check it has not expired or been used, then mark it used and do whatever the link is meant to do. Always send it over HTTPS, keep the lifetime short, and never put anything sensitive in the URL itself. The alternative is a stateless signed token such as a JWT or an HMAC over the payload plus expiry, which avoids a database table but makes single-use and revocation harder. In Spring you would expose this as a normal controller endpoint and permit just that path in your Spring Security config, while the token check itself decides who gets in.