liveBook · Manning

@Secured

As explained in Spring Security in Action, Second Edition

@Secured is a Spring Security annotation that restricts access to methods or classes based on configured security attributes.

@Secured restricts access to a method by requiring a configured security attribute, such as ROLE_ADMIN. Method-level security is disabled by default; enable it with @EnableMethodSecurity(securedEnabled = true). section 11.4

Protecting a service method

Annotate the method with @Secured("ROLE_ADMIN"). An authenticated administrator can call getName(), while another authenticated user receives HTTP 403 Forbidden.

@Secured and @RolesAllowed are simpler and less powerful than @PreAuthorize and @PostAuthorize, so use them for straightforward role checks. section 11.4

How Spring Security in Action, Second Edition covers it

How deep it goes
Defines activation and demonstrates a role check, while deferring richer authorization rules to pre- and postauthorization.
Examples
Uses NameService.getName(), ROLE_ADMIN, successful administrator access, and a 403 response for another user.
What it assumes
Configure method security with @EnableMethodSecurity before expecting @Secured annotations to take effect.
What you can do after
Apply it via Spring Security to enforce straightforward role checks on methods and recognize denied requests as HTTP 403.
How it connects
Connects method security with @EnableMethodSecurity, @RolesAllowed, @PreAuthorize, and @PostAuthorize.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.