A role is a coarse-grained label that groups permissions for an authenticated user. Spring Security evaluates roles during authorization, after authentication has placed the user's details in the security context. section 7.0 section 7.1.2
Use roles when users repeatedly receive the same collection of actions:
- Represent fine-grained actions such as read, write, update, or delete as authorities. section 7.1
- Group those actions under labels such as READER, MANAGER, or ADMIN. section 7.1.2
- Store the role through the user's authorities; internally, roles use the GrantedAuthority contract and normally carry the ROLE_ prefix. section 7.1.2
- Authorize an endpoint with hasRole("ADMIN"), allowing only users assigned the ADMIN role. section 7.1.2
Restrict an endpoint to administrators
Assign john the ADMIN role and jane the MANAGER role with roles("ADMIN") and roles("MANAGER"). Configure authorizeHttpRequests with anyRequest().hasRole("ADMIN"). A request authenticated as john succeeds, while jane receives HTTP 403 Forbidden. section 7.1.2
Figure 7.5 Roles are coarse grained. Each user with a specific role can only do the actions granted by that role. When applying this philosophy in authorization, a request is allowed based on the purpose of the user in the system. Only users who have a specific role can call a certain endpoint.
Visualize a role as a coarse-grained badge: each assigned role permits only the actions granted by that role and can control access to an endpoint. section 7.1.2
