Role-Based Access Control with @PreAuthorize

From URL Matching to Method-Level Security

So far, our security rules have been defined centrally in our SecurityConfig class using requestMatchers. This is an excellent approach for applying broad rules, like "all endpoints under /api/v1/admin/** require authentication." However, it has its limits. What if two methods share the same base URL but require different levels of access? Or what if you want to secure a method in the service layer, completely bypassing the controller?

This is where method-level security shines. It allows us to place authorization rules directly on the methods that need protection. This co-locates the security logic with the business logic, often making the code easier to read and maintain.

To enable this capability, our first step is to tell Spring we intend to use method-level security annotations.

Enabling Method Security

In your SecurityConfig.java file, add the @EnableMethodSecurity annotation to the class definition.

@Configuration
@EnableWebSecurity
@EnableMethodSecurity // Add this annotation
public class SecurityConfig {
    // ... your existing configuration
}

This annotation enables Spring's pre-post annotations, most notably @PreAuthorize. It works by using Aspect-Oriented Programming (AOP) to wrap the annotated methods with security checks.

The following resources provide excellent explanations for this crucial first step.

Setting Up the Data Model for Roles

Before we can authorize based on roles, our application needs a concept of what a role is and how it's assigned to a user. We will now update our data model to include this. The process involves three main parts:

1. Defining the Role entity.
2. Associating the User entity with a Role.
3. Exposing the user's role to Spring Security.

The blog post "Build a Role-based Access Control in a Spring Boot 3 API" provides a perfect, step-by-step guide for this.

After completing these steps, your application will have a proper data model for roles, and more importantly, the Authentication object in Spring's SecurityContext will be populated with the correct authorities for the logged-in user.

Securing Methods with @PreAuthorize

With our roles set up and method security enabled, we can now protect our methods. The @PreAuthorize annotation is incredibly flexible, using Spring Expression Language (SpEL) to define access rules.

Let's say you have a UserController with two methods: one to fetch the current user's profile (/me) and another to list all users.

• /me should be accessible by any authenticated user.
• /users should only be accessible by users with an ADMIN role.

Here’s how you would apply @PreAuthorize:

@RestController
@RequestMapping("/users")
public class UserController {

    // ... constructor and other fields

    @GetMapping("/me")
    @PreAuthorize("isAuthenticated()") // Any authenticated user can access this
    public ResponseEntity<User> authenticatedUser() {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        User currentUser = (User) authentication.getPrincipal();
        return ResponseEntity.ok(currentUser);
    }

    @GetMapping
    @PreAuthorize("hasRole('ADMIN')") // Only users with the 'ADMIN' role
    public ResponseEntity<List<User>> allUsers() {
        List<User> users = userService.allUsers();
        return ResponseEntity.ok(users);
    }
}

Common @PreAuthorize Expressions:

• isAuthenticated(): Returns true if the user is not anonymous.
• hasRole('ROLE_NAME'): Returns true if the current user has the specified role. Note that you don't include the ROLE_ prefix here; Spring adds it automatically.
• hasAnyRole('ROLE_1', 'ROLE_2'): Returns true if the user has any of the roles in the list.
• hasAuthority('PERMISSION_NAME'): Checks for a specific permission (authority). hasRole('ADMIN') is largely equivalent to hasAuthority('ROLE_ADMIN').

The following image illustrates this flow conceptually. A request comes in, Spring Security authenticates the user and identifies their role, and then it checks if that role has permission to access the requested resource.

The article from Teco Tutorials provides code examples for applying these annotations.

How Does it Work? The Magic of AOP

You might be wondering how simply adding an annotation can enforce such complex security logic. The answer lies in Aspect-Oriented Programming (AOP).

When you add @EnableMethodSecurity, Spring creates a proxy object around your controller (or any bean with a security annotation). When a call is made to a secured method like allUsers(), the call is first intercepted by a special component, the AuthorizationManagerBeforeMethodInterceptor.

This interceptor reads the SpEL expression from your @PreAuthorize("hasRole('ADMIN')") annotation. It then evaluates this expression against the current user's Authentication object. If the expression returns true, the interceptor passes the call along to your actual allUsers() method. If it returns false, the interceptor throws an AccessDeniedException, which Spring translates into an HTTP 403 Forbidden response, stopping the method from ever being executed.

This video from CodeSnippet provides a fantastic visual and technical breakdown of this interception mechanism.

Conclusion

Today, you have moved from authentication to authorization, adding a critical layer of security to your application. By defining roles and using method-level security, you can now enforce the principle of least privilege with precision, ensuring users can only perform actions they are explicitly permitted to.

Key Takeaways:

• Method-level security provides fine-grained control by placing authorization rules directly on Java methods.
• You must add @EnableMethodSecurity to your security configuration to activate this feature.
• The @PreAuthorize annotation uses Spring Expression Language (SpEL) to check permissions before a method is executed.
• Common expressions include isAuthenticated(), hasRole(), and hasAnyRole().
• Your UserDetails implementation must correctly expose roles via the getAuthorities() method, typically by returning SimpleGrantedAuthority objects prefixed with ROLE_.
• This mechanism is powered by Spring AOP, which intercepts method calls to perform security checks.

In our next and final module, we will shift our focus to ensuring the quality and reliability of the code you've written. Our first lesson will cover how to write unit tests for your service layer components using JUnit 5 and Mockito, two essential tools in the Java ecosystem.