Authorization decides whether an authenticated entity may access a resource or perform an action. Spring Security evaluates the request after authentication, using the authenticated user’s authorities and configured rules. section 7.0 section 7.2
Configure access control at several application boundaries:
- Define authorities as named permissible actions, such as READ, WRITE, or DELETE, and attach them to UserDetails. section 7.1
- Restrict endpoints with hasAuthority(), hasAnyAuthority(), permitAll(), denyAll(), or custom access expressions. section 7.1.1 section 7.2
- Select endpoint rules by path and HTTP method with requestMatchers(), using regular expressions when path expressions are insufficient. section 8.4
- Protect service or other application-layer methods with @PreAuthorize or @PostAuthorize after enabling method security. section 11.5
- Keep complex authorization logic in a separate PermissionEvaluator rather than making expressions difficult to read. section 11.5
Require WRITE authority
A SecurityFilterChain can require authentication and then restrict every endpoint to users with WRITE authority: http.authorizeHttpRequests(c -> c.anyRequest().hasAuthority("WRITE")). A user with WRITE receives the endpoint response; an authenticated user without it receives HTTP 403 Forbidden.
