Code reviewMediumcr-g035

Subject Missing authorizationLevel Mid–Senior~25 minCommon in Security interviewsIndustries Software development

Question

Review this Java Spring controller for downloading an invoice.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjava

1@GetMapping("/api/invoices/{id}")2public ResponseEntity<InvoiceDto> getInvoice(@PathVariable Long id,3                                            @AuthenticationPrincipal User me) {4    Invoice inv = invoiceRepo.findById(id)5            .orElseThrow(() -> new NotFoundException());6    return ResponseEntity.ok(InvoiceMapper.toDto(inv));7}

Run or narrate your approach, then ask the coach.