Skip to main content
Advertisement

12.5 Object-Level Navigation: Method Security (@PreAuthorize)

The blanket parameter requestMatchers("/api/admin/**").hasRole("ADMIN") meticulously configured explicitly inside the SecurityFilterChain manifests strictly as a macro-level routing defensive firewall based purely on static HTTP URL Endpoints. However, whenever you intend to meticulously "Monitor dynamic parameters or granular statuses precisely during the pure execution invocation of a specific distinct Business method", you pivot assertively leaning onto Method Security.

1. Enabling @EnableMethodSecurity​

Since the dawn of Spring Security 6 (Boot 3.x architectures), the deprecated legacy variant @EnableGlobalMethodSecurity has been gracefully retired, definitively superseded natively by @EnableMethodSecurity.

@Configuration
@EnableWebSecurity
@EnableMethodSecurity // Enabling this singular annotation seamlessly arms @PreAuthorize, @Secured methodologies globally.
public class SecurityConfig {
    // ...
}

2. Practical Syntax of @PreAuthorize and @PostAuthorize​

This emerges globally as the most omnipotent and astoundingly flexible security construct firmly anchored upon (SpEL - Spring Expression Language) evaluations. You seamlessly wield the capability to intercept and evaluate parameters strictly Immediately Prior to method combustion (@PreAuthorize) or audit precisely the retrieved entity payload Immediately Afterward execution finishes (@PostAuthorize).

@Service
@RequiredArgsConstructor
public class BoardService {

    // 1. Rudimentary Role Verifications (Only authorities wielding ADMIN rank may invoke)
    @PreAuthorize("hasRole('ADMIN')")
    public void deleteNotice(Long boardId) { ... }

    // 2. Cross-referencing Parameters heavily against the active Logged-In User (Principal) natively (Only Authors can access non-published posts)
    @PreAuthorize("#userId == authentication.principal.id or hasRole('ADMIN')")
    public BoardDto getPrivatePost(Long boardId, Long userId) { ... }

    // 3. Inspecting the natively Extracted Object Results (PostAuthorize - System physically executes the method unconditionally, but brutally halts returning the payload object bridging back to the caller entirely unless permissions align logically)
    @PostAuthorize("returnObject.ownerId == authentication.principal.id")
    public CustomDocument fetchSecretDocument(Long docId) {
        return documentRepository.find(docId); // The DB Query actually executed already!
    }
}

3. Bridging Natively with Custom Authorization Validation Beans​

When authorization filtering permutations escalate enormously reaching profound complexity defying single-line SpEL comprehension architectures, you uniquely possess the flexibility to organically invoke entirely isolated Custom Spring Beans (@Component Beans). This paradigm natively yields awe-inspiring flexibility extensively utilized inside high-stress commercial production zones.

@Component("boardSecurity")
public class BoardSecurityEvaluator {
    public boolean isOwner(Long boardId, CustomUserDetails user) {
        // Return resilient true/false natively after traversing extremely complex DB sub-queries or deeply analyzing relationship hierarchy statuses
        return boardRepository.checkOwnerShip(boardId, user.getId());
    }
}

Invocation Syntax:

// @SecurityBeanName.methodName(ParameterVariables, embedded native 'authentication.principal' (UserObject))
@PreAuthorize("@boardSecurity.isOwner(#boardId, principal)")
public void updatePost(Long boardId, PostUpdateDto dto) {
    // ...Safely executes rigorous Board Post mutations
}

Thus gracefully alleviating and utterly eliminating all toxic bloated visual if (user.getId() != board.getOwnerId()) throw Exception(); imperative code redundancies buried inherently deep scattered across your core business logics, achieving absolute masterful AOP architectural dissociation.

Advertisement
Advertisement