Snippet

Restricting Method Access by User Role Using PreAuthorize

The @PreAuthorize annotation evaluates a Spring Expression Language (SpEL) expression before invoking a method. It denies invocation and throws an AccessDeniedException if the current authenticated principal lacks the required role.

snippet.java

java

@Service
public class UserService {
 
    @PreAuthorize("hasRole('ADMIN')")
    public void deleteUserAccount(Long userId) {
        System.out.println("Admin deleted user with ID: " + userId);
    }
}

spring

Breakdown

@Service

Marks the class as a service layer component in the Spring context.

@PreAuthorize("hasRole('ADMIN')")

Checks if the authenticated user has the 'ROLE_ADMIN' authority before allowing the method to run.

public void deleteUserAccount(Long userId) {

Executes sensitive deletion logic only when authorization check succeeds.

Previous snippet Next snippet

More Beginner Java exercises →

Restricting Method Access by User Role Using PreAuthorize

Related