Chapter 11: Implementing authorization at the method level
Introduces method security as a way to apply authorization beyond HTTP endpoints in both web and non-web applications.
After this chapter you will be able to
- Method-level authorization scope. Explain why method security is useful in non-web applications and how it extends authorization in web applications beyond the endpoint level.
- Method Security Purpose and Availability. Explain why method-level authorization is useful when endpoint-level rules are insufficient, and state whether method security is enabled by default.
- Call Authorization Decisions. Distinguish preauthorization from postauthorization in call authorization.
- Method call authorization mechanism. Explain that enabling method security enables a Spring aspect that intercepts calls to protected methods and applies authorization rules. Describe the two possible timings for a call-authorization check.
- Preauthorization before method execution. Describe how preauthorization checks rules before a method executes, preventing the call and throwing AccessDeniedException when the rules fail. Explain how a rule can use the authenticated user and method parameters, as in limiting document retrieval to the user’s own documents.
- Postauthorization after method execution. Explain that postauthorization checks rules after a method executes, allowing a rule to use its return value to decide whether the caller may access that value. Describe why a failed check does not undo changes the method has already made, even with @Transactional.
- Method security activation. Explain how to enable method security in a Spring Security project and which authorization annotations are available by default afterward.
- Authority-based method preauthorization. Explain how @PreAuthorize restricts a service method to users with write authority and what happens when a user lacks it.
- Parameter-based authorization rule. Trace how the secret-names example allows a call only when the method's name parameter matches the authenticated user's username.
- Postauthorization timing and purpose. Explain why postauthorization lets a method run before deciding whether its caller may receive the result, especially when the decision depends on retrieved data.
- PostAuthorize returned object rule. Describe how @PostAuthorize specifies a SpEL authorization rule and how that rule can refer to the method’s returned value through returnObject.
- Reason for permission evaluators. Explain why complex authorization logic belongs in a separate class rather than a long SpEL expression.
- Permission evaluator inputs. Distinguish the two ways a PermissionEvaluator can receive the subject of an authorization rule, and explain where its Authentication argument comes from.
- Postauthorization document rule. Trace how the document example applies an admin-or-owner rule to a returned document and makes its evaluator available to method security.
- Preauthorization by document identifier. Explain why the preauthorization version passes a document identifier and type instead of the document object, and state how its access outcome compares with the postauthorization version.
What it builds on
- Selecting requests to apply authorization restrictions (chapter 8) · Assumes familiarity with authorization restrictions applied to endpoint requests.
- Using and configuring HTTP Basic (chapter 6) · HTTP Basic as an authentication approach.
- Restricting access for all endpoints based on user authorities (chapter 7) · Restricting access based on user authorities.
- Using the SecurityContext (chapter 6) · The SecurityContext holds authentication information.
Section by section
Introduction
Introduces method security as a way to apply authorization beyond HTTP endpoints in both web and non-web applications.
- Method-level authorization scope: Explain why method security is useful in non-web applications and how it extends authorization in web applications beyond the endpoint level.
Why it matters: It explains when endpoint-level authorization is insufficient and why method security is useful.
Key terms: method security, authorization, endpoint level, app layers
11.1 Enabling method security
This section explains why method-level authorization is useful, notes that method security must be enabled, and distinguishes call authorization from filtering.
- Method Security Purpose and Availability: Explain why method-level authorization is useful when endpoint-level rules are insufficient, and state whether method security is enabled by default.
Why it matters: It tells you when method security is worth using and why its rules will not apply until you enable it. - Call Authorization Decisions: Distinguish preauthorization from postauthorization in call authorization.
Why it matters: The distinction identifies whether an authorization decision concerns calling the method or accessing its result. - Method Filtering Directions: Distinguish prefiltering from postfiltering by what each controls.
Why it matters: It separates filtering method inputs from filtering what is returned to a caller.
Key terms: method security, endpoint level, call authorization, preauthorization, postauthorization, filtering, prefiltering, postfiltering
11.1.1 Understanding call authorization
This subsection explains how a Spring aspect enforces method-call authorization and contrasts checks made before execution with checks made after execution.
- Method call authorization mechanism: Explain that enabling method security enables a Spring aspect that intercepts calls to protected methods and applies authorization rules. Describe the two possible timings for a call-authorization check.
Why it matters: The interception point explains how authorization can govern a method call without being part of the method’s logic. - Preauthorization before method execution: Describe how preauthorization checks rules before a method executes, preventing the call and throwing AccessDeniedException when the rules fail. Explain how a rule can use the authenticated user and method parameters, as in limiting document retrieval to the user’s own documents.
Why it matters: A failed preauthorization check stops protected logic from executing at all. - Postauthorization after method execution: Explain that postauthorization checks rules after a method executes, allowing a rule to use its return value to decide whether the caller may access that value. Describe why a failed check does not undo changes the method has already made, even with @Transactional.
Why it matters: A postauthorization rule can protect a returned value, but it is too late to stop side effects of the method.
Key terms: call authorization, method security, Spring aspect, preauthorization, postauthorization, authenticated user, method parameters, AccessDeniedException, method return, @Transactional
11.1.2 Enabling method security in your project
This section shows how to enable method security and identifies the authorization approach used in the chapter’s examples.
- Method security activation: Explain how to enable method security in a Spring Security project and which authorization annotations are available by default afterward.
Why it matters: Without enabling method security, you cannot apply the method-level authorization rules used in the following sections. - Authentication choice for method security: Explain whether method security requires a particular authentication approach and why the chapter’s example uses HTTP Basic.
Why it matters: The example’s use of HTTP Basic is a simplifying choice, not a requirement of method security.
Key terms: method security, @EnableMethodSecurity, pre-/postauthorization annotations, global method security, HTTP Basic authentication, OAuth 2
11.2 Applying preauthorization rules
Shows how to protect methods with preauthorization rules based on a user's authority or on a method parameter, and notes where method security can be applied.
- Authority-based method preauthorization: Explain how @PreAuthorize restricts a service method to users with write authority and what happens when a user lacks it.
Why it matters: It lets you protect the service operation itself, not just the endpoint that calls it. - Parameter-based authorization rule: Trace how the secret-names example allows a call only when the method's name parameter matches the authenticated user's username.
Why it matters: A method rule can take the requested value into account rather than relying only on a user's general authority. - Method security placement: State where method security rules can be applied beyond the service classes used in the examples.
Why it matters: The service-class examples illustrate a broader way to protect methods throughout an application.
Key terms: @PreAuthorize, Spring Expression Language (SpEL), hasAuthority(), write authority, preauthorization, #name, authentication.principal.username, getSecretNames(), method parameters, method security
11.3 Applying postauthorization rules
This section explains how to use postauthorization to check a method’s returned value before exposing it to the caller.
- Postauthorization timing and purpose: Explain why postauthorization lets a method run before deciding whether its caller may receive the result, especially when the decision depends on retrieved data.
Why it matters: It distinguishes protecting a returned value from preventing a method call. - PostAuthorize returned object rule: Describe how @PostAuthorize specifies a SpEL authorization rule and how that rule can refer to the method’s returned value through returnObject.
Why it matters: It connects the after-call decision to the value the method actually returned. - Employee result access example: Explain why either authenticated user can obtain Emma’s employee details but neither can obtain Natalie’s in the section’s example.
Why it matters: It shows that the rule checks the returned employee record, not simply the caller’s identity.
Key terms: postauthorization, returned value, @PostAuthorize, SpEL, returnObject, @PreAuthorize, Employee, reader, roles
11.4 Implementing permissions for methods
This section shows how to move complex method-authorization rules into a permission evaluator, apply them before or after a method call, and use simpler role-based annotations.
- Reason for permission evaluators: Explain why complex authorization logic belongs in a separate class rather than a long SpEL expression.
Why it matters: Separating the rule keeps method security readable when authorization requires more than a short expression. - Permission evaluator inputs: Distinguish the two ways a PermissionEvaluator can receive the subject of an authorization rule, and explain where its Authentication argument comes from.
Why it matters: The available subject determines which evaluator method fits a pre- or postauthorization check. - Postauthorization document rule: Trace how the document example applies an admin-or-owner rule to a returned document and makes its evaluator available to method security.
Why it matters: This connects the rule in a separate class to the method result that the rule protects. - Preauthorization by document identifier: Explain why the preauthorization version passes a document identifier and type instead of the document object, and state how its access outcome compares with the postauthorization version.
Why it matters: An access decision can be made before execution even when the protected object has not yet been returned. - Simpler role annotation options: Describe how @Secured and @RolesAllowed are enabled and what kinds of method restrictions they express compared with pre- and postauthorization.
Why it matters: These annotations provide another way to recognize and express straightforward method-access restrictions.
Key terms: SpEL, permission, authorization rules, PermissionEvaluator, hasPermission(), Authentication, SecurityContext, @PostAuthorize, returnObject, MethodSecurityExpressionHandler
11.5 Summary
Where this is used later
- Applying prefiltering for method authorization (chapter 12) · Prefiltering applies the input side of this distinction.
- Applying postfiltering for method authorization (chapter 12) · Postfiltering applies the returned-output side of this distinction.
- (chapter intro) (chapter 12) · Introduces preauthorization as a rule that can reject a method call.
- Managing authorization for an OAuth 2 login (chapter 16) · Using postauthorization annotations.
- Testing method security (chapter 18) · Provides a reason to test custom method-authorization rules.
Concepts explained in this chapter
- method-level securityGlobal method security is a method-authorization capability that applies authorization rules across application methods.
- authorizationAuthorization is the process of determining whether an authenticated entity has permission to perform an action or access a resource.
- @PostAuthorizePostAuthorize is a Spring Security annotation that authorizes access to a method's result by evaluating an expression after the method executes.
- @EnableMethodSecurity@EnableMethodSecurity is a Spring Security annotation that enables method-level authorization support and selected method-security annotations.
- preauthorizationPreauthorization is authorization checking performed before a protected method executes, preventing the call when its conditions are not satisfied.
- postauthorizationPostauthorization is authorization evaluation performed after a method executes, using the method's returned value to decide whether the caller may receive it.
- PermissionEvaluatorPermissionEvaluator is a Spring Security interface for evaluating whether an authenticated principal has permission on a target object or operation.
- @RolesAllowed@RolesAllowed is a JSR-250 security annotation that restricts access to methods based on the roles assigned to the caller.
- @Secured@Secured is a Spring Security annotation that restricts access to methods or classes based on configured security attributes.
- MethodSecurityExpressionHandlerMethodSecurityExpressionHandler is a Spring Security interface for creating and configuring expression evaluation for method-level security.
- hasPermission()hasPermission() is a Spring Security expression that delegates an authorization decision to a permission evaluator for a specified object or identifier.
- @PreAuthorize@PreAuthorize is a Spring Security annotation that authorizes a method invocation by evaluating a Spring Expression Language expression before the method runs.
- call authorizationCall authorization is method-level authorization that decides whether a method may be called or whether its returned value may be accessed.
- Spring Expression LanguageSpring Expression Language is an expression language for querying and manipulating object graphs within Spring applications.
- filteringFiltering is a method-security technique that restricts method input parameters or returned results according to authorization rules.
- aspectAn aspect is a modular unit that encapsulates behavior applied across selected program execution points, commonly by intercepting method calls.
- postfilteringPostfiltering is filtering applied to a method's returned data before the caller receives it.
- prefilteringPrefiltering is filtering applied to a method's input parameters before the method receives them.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.