Method security
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
protect service methods with annotations.
Planned topics
- Turn it on with
@EnableMethodSecurity. @PreAuthorize("hasRole('ADMIN')")runs before the method.- SpEL can use method arguments and the current user:
@PreAuthorize("#id == authentication.principal.id"). - Put it on the service layer so every caller, not only controllers, is covered.
- URL rules are a first layer; method rules are a second layer (defense in depth).
Draft outline details
Demonstration
@PreAuthorize("hasRole('ADMIN')")
public void deleteProduct(long id) { ... }Check your understanding
Which annotation enables @PreAuthorize?
Show answer
@EnableMethodSecurity.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.