Call authorization

As explained in Spring Security in Action, Second Edition

Call authorization is method-level authorization that decides whether a method may be called or whether its returned value may be accessed.

Call authorization applies method-level rules to decide whether a method may run or whether its returned value may reach the caller. Method security is disabled by default; enabling it activates an aspect that intercepts protected calls. section 11.1 section 11.1.1

Use two authorization points:

• Preauthorization checks rules before delegation and blocks the method call when they fail. section 11.1.1
• Postauthorization allows execution, then checks whether the caller may receive the returned value. section 11.1.1

Restricting document lookup

A method such as findDocumentsByUser(String username) can use preauthorization to ensure the supplied username matches the authenticated user, preventing access to another user’s documents. section 11.1.1

Figure 11.2 When we enable global method security, an aspect intercepts the call to the protected method. If the given authorization rules aren’t respected, the aspect doesn’t delegate the call to the protected method.

Follow the interception flow from the protected method call to delegation or rejection. section 11.1.1

How Spring Security in Action, Second Edition covers it

How deep it goes

Explains aspect interception and contrasts preauthorization with postauthorization through an application example.

Examples

Uses user-specific document lookup to demonstrate authorization based on method parameters.

What you can do after

Apply via Spring Security method security to protect calls or returned values with authorization rules.

How it connects

Connects method security with aspect-oriented programming, preauthorization, postauthorization, and filtering.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

• filteringcontrasts with · Filtering is the operation of selecting or excluding items from a collection according to specified criteria.
• method-level securityuses · Method-level security is authorization enforced on individual method invocations according to the caller’s identity or authorities.
• postauthorizationincludes · Postauthorization is authorization evaluation performed after a method executes, using the method's returned value to decide whether the caller may receive it.
• preauthorizationincludes · Preauthorization is authorization checking performed before a protected method executes, preventing the call when its conditions are not satisfied.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.