liveBook · Manning

Postauthorization

As explained in Spring Security in Action, Second Edition

Postauthorization is authorization evaluation performed after a method executes, using the method's returned value to decide whether the caller may receive it.

Postauthorization evaluates an authorization rule after a method executes. The method is allowed to run, but its returned value is withheld when the result fails the rule. section 11.1.1 section 11.3

Implement postauthorization in Spring Security by following these steps:

  • Enable method security with @EnableMethodSecurity on the configuration class. section 11.1.2
  • Annotate the protected method with @PostAuthorize and provide a SpEL authorization expression. section 11.3

Protecting employee details

A BookService method can return an Employee only when its roles contain reader: @PostAuthorize("returnObject.roles.contains('reader')"). Emma’s record satisfies the rule, so the details are returned. Natalie’s record does not, so the request receives a 403 Forbidden response. Natalie can still retrieve Emma’s record because the authorization decision uses the returned employee, not the authenticated user alone.

How Spring Security in Action, Second Edition covers it

How deep it goes
Traces interception, method execution, result evaluation, and rejection, while deferring complex logic to a separate PermissionEvaluator.
Examples
Demonstrates Employee records, role checks, HTTP Basic requests, JSON responses, and 403 Forbidden outcomes.
What it assumes
Assumes basic Spring configuration and authentication, while requiring explicit method-security enablement before annotations take effect.
What you can do after
Apply it via @PostAuthorize to prevent callers from receiving method results that fail a SpEL authorization rule.
How it connects
Contrasts with preauthorization and uses method security, SpEL expressions, and PermissionEvaluator for authorization decisions.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.