Method-level security applies authorization rules to application methods rather than limiting protection to HTTP endpoints. It supports web and non-web applications, and lets different application layers enforce access decisions. section 11.0 section 11.5
Spring Security disables method security by default. Add @EnableMethodSecurity to a configuration class to enable preauthorization and postauthorization; filtering is also available for method parameters and return values. section 11.1 section 11.1.2
Choose the authorization mechanism according to where the decision belongs:
- Use @PreAuthorize with a SpEL expression to reject a method call before execution. section 11.1.1 section 11.5
- Use @PostAuthorize to execute the method and then decide whether the caller may receive its return value. section 11.1.1 section 11.5
- Use filtering when authorization must control method parameters or returned collections; filtering is treated separately from call authorization. section 11.1
- Use a PermissionEvaluator to move complex permission logic out of an annotation expression and configure it through the method-security expression handler. section 11.4 section 11.5
Protecting document access
A DocumentService can protect getDocument(String code) with @PostAuthorize("hasPermission(returnObject, 'ROLE_admin')"). A custom PermissionEvaluator grants access when the caller has the administrator authority or owns the returned document. The equivalent preauthorization form evaluates the document identifier before execution with hasPermission(#code, 'document', 'ROLE_admin'). Natalie can retrieve Natalie’s documents and, as an administrator, Emma’s; Emma receives 403 for Natalie’s document. section 11.4
Method security works through a Spring aspect that intercepts protected method calls. The aspect either delegates to the method or prevents delegation according to the authorization expression, making the rule effective even when no endpoint exists. section 11.1.1 section 11.0
Test protected methods by injecting the secured bean directly instead of using MockMvc. Cover unauthenticated calls, authenticated callers with the wrong authority, and successful calls with the expected authority. section 18.4
Figure 11.1 Method security allows you to be more granular and apply authorization rules at any specifically chosen level of your application.
Use this figure to compare endpoint-only authorization with granular rules applied at a specifically chosen application level. section 11.0
