How to prevent malicious input in Spring JPA+Spring REST+jHipster -

i'm new spring jpa/jhipster. question inspired jhipster talk julien dubois: https://youtu.be/r3jm2qmqcti?t=43m7s

assume have bank account operations on (+100$ restaurant, -50$ atm, ...) each bank account has owner of course.

the payload of post rest call creates operation this: {"amount":100,"description":"restaurant","bankaccount":{"id":1136}}

the id of bankaccount unique , (for sake of example) have been sent me earlier via rest call.

unfortunately, nothing prevents malicious user change value. 1 guess id of bankaccount owned else, , operation added one.

i have not (yet) seen examples deal problem.
should explicitly check if bankaccount owned user? imagine type of verification may cascade through entities, causing lot of calls. maybe i'm missing something?

thanks, andy

yes it's reponsibility check in rest controller or underlying services operation authorized. spring security offers different mechanisms it in particular using @preauthorize , @postfilter.

it's thing use dtos, way can better control fields of entities exposed reading , writing through api.