Method-level security
Method-level security is authorization enforced on individual method invocations according to the caller’s identity or authorities.
Spring Security in Action, Second Edition
Global method security is a method-authorization capability that applies authorization rules across application methods.
- How it is used
- Protects methods across web and non-web application layers when endpoint authorization is too coarse.
- How deep it goes
- Descends to annotations, SpEL expressions, AOP interception, and custom evaluators, while deferring filtering details.
- Examples
- Uses document ownership, administrator permissions, @RolesAllowed, @Secured, curl requests, and direct method-security tests.
- What you can do after
- Apply it via Spring Security annotations, SpEL rules, custom PermissionEvaluator implementations, and focused authorization tests.
Read how Spring Security in Action, Second Edition explains method-level security →
Spring AI in Action
Method-level security is authorization enforced when application methods are invoked based on the caller's identity or authorities.
- How it is used
- Protects application and LLM-tool methods from unauthorized callers.
- How deep it goes
- Explains configuration, annotations, SpEL evaluation, role checks, and denied invocations.
- Examples
- Uses getGameComplexity, Function.apply(), PREMIUM_USER, and Burger Battle requests.
- What you can do after
- Apply it via Spring Security annotations to restrict methods and tools by role.
Read how Spring AI in Action explains method-level security →
Related concepts
- @EnableMethodSecurityconfigured by · @EnableMethodSecurity is a Spring Security annotation that enables authorization checks on secured method invocations.
- Spring Securityused by · Spring Security is a Spring framework for implementing application authentication, authorization, access control, and protection against common security threats.
- call authorizationused by · Call authorization is method-level authorization that decides whether a method may be called or whether its returned value may be accessed.
- authorizationimplements · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
- @PreAuthorizeconfigured by · @PreAuthorize is a Spring Security annotation that evaluates an authorization expression before permitting an annotated method invocation.
- aspectused by · An aspect is a modular unit of cross-cutting behavior applied around selected program operations or method invocations.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.