java / expert
Snippet
Dynamic Method Security with SpEL Expressions
Spring Security enables fine-grained access control using Spring Expression Language (SpEL). By referencing custom beans within @PreAuthorize, complex authorization rules can be externalized and reused.
snippet.java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
@Servicepublic class DocumentService {@PreAuthorize("@securityService.isOwner(#id) or hasRole('ADMIN')")public Document getDocument(Long id) {return repository.findById(id).orElseThrow();}}@Component("securityService")public class SecurityService {public boolean isOwner(Long id) {String currentUser = SecurityContextHolder.getContext().getAuthentication().getName();// Database check logic herereturn true;}}
spring
Breakdown
1
@PreAuthorize("@securityService.isOwner(#id) ...")
Uses SpEL to call a method on a Spring bean before method execution.
2
SecurityContextHolder.getContext().getAuthentication()
Accesses the current authenticated user's details from the security context.
3
or hasRole('ADMIN')
Standard Spring Security expression combined with custom logic using logical operators.