Spring Security 6 & JWT Authentication · Lesson

Method-Level Security with Annotations

Secure individual methods in your service layer using Spring Security annotations like `@PreAuthorize` and `@PostAuthorize`.

Method-Level Security with Annotations is a free Spring Security 6 & JWT Authentication lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Spring Security 6 & JWT Authentication learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Intro to Method Security

Welcome! In Spring Security, we often secure web endpoints using HttpSecurity. But what if you need finer control within your application logic?

Method-level security lets you protect individual methods in your service layer, ensuring only authorized users can call them. This adds another powerful layer of defense!

Enabling Method Security

To use method-level security, you need to enable it in your Spring Security configuration. This is done with the @EnableMethodSecurity annotation.

Place it on your main security configuration class, usually one extending WebSecurityConfigurerAdapter (though in Spring Security 6, you often just use a @Configuration class with a FilterChainBean).

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

@Configuration
@EnableMethodSecurity // Enables @PreAuthorize, @PostAuthorize, etc.
public class SecurityConfig {
    // Your security filter chain bean goes here
}

@PreAuthorize: Before Execution

The @PreAuthorize annotation checks authorization before a method is executed. If the condition isn't met, the method won't run, and an AccessDeniedException is thrown.

It uses Spring Expression Language (SpEL) to define powerful authorization rules. Common uses include checking roles or specific authorities.

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;

@Service
public class AdminService {

    @PreAuthorize("hasRole('ADMIN')")
    public String deleteSensitiveData() {
        return "Sensitive data deleted!";
    }

    @PreAuthorize("hasAuthority('product:write')")
    public String createProduct(String productName) {
        return "Product '" + productName + "' created.";
    }
}

Running @PreAuthorize Example

Let's see @PreAuthorize in action. This runnable example simulates how Spring Security would process the hasRole('ADMIN') check by manually setting a user's role in the security context.

Try running it to see how access is granted or denied based on the assigned role.

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import java.util.Collections;
import java.util.List;

public class Main {

    // This method simulates a service method protected by @PreAuthorize("hasRole('ADMIN')")
    public static String getAdminMessage() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        // In a real Spring app, AOP would handle this check before method entry.
        // We simulate it here for demonstration.
        if (auth != null && auth.getAuthorities().stream()
                .anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"))) {
            return "Welcome, Admin! Here's your secret message.";
        } else {
            return "Access Denied: ADMIN role required.";
        }
    }

    public static void main(String[] args) {
        // Scenario 1: User with ADMIN role
        List<GrantedAuthority> adminAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_ADMIN"));
        Authentication adminAuth = new UsernamePasswordAuthenticationToken("adminUser", "pass", adminAuthorities);
        SecurityContextHolder.getContext().setAuthentication(adminAuth);
        System.out.println("Admin user attempt: " + getAdminMessage());

        // Scenario 2: User with USER role
        List<GrantedAuthority> userAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
        Authentication userAuth = new UsernamePasswordAuthenticationToken("regularUser", "pass", userAuthorities);
        SecurityContextHolder.getContext().setAuthentication(userAuth);
        System.out.println("\nRegular user attempt: " + getAdminMessage());

        SecurityContextHolder.clearContext(); // Clean up
    }
}

SpEL for Dynamic Checks

@PreAuthorize can do more than just check roles! You can use SpEL to access method arguments, the authenticated principal, or even custom beans.

For example, #userId refers to a method parameter named userId. authentication.principal.username gets the current user's username.

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;

@Service
public class UserService {

    // Only allow users to view their own profile
    @PreAuthorize("#userId == authentication.principal.username")
    public String viewUserProfile(String userId) {
        return "Viewing profile for: " + userId;
    }

    // Allow ADMIN or the owner of the resource
    @PreAuthorize("hasRole('ADMIN') or #resourceOwner == authentication.principal.username")
    public String editResource(String resourceId, String resourceOwner) {
        return "Editing resource '" + resourceId + "' by '" + resourceOwner + "'.";
    }
}

@PostAuthorize: After Execution

Sometimes, you need to make an authorization decision after the method has executed and you have access to its return value. This is where @PostAuthorize comes in.

It's useful for ensuring that the authenticated user is allowed to *see* the data that was just retrieved or processed by the method. You can access the return value using returnObject in SpEL.

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;

// A simple data class for demonstration
class UserProfile {
    String username;
    String email;
    public UserProfile(String username, String email) {
        this.username = username;
        this.email = email;
    }
    public String getUsername() { return username; }
    public String getEmail() { return email; }
}

@Service
public class ProfileService {

    // Only allow access to profile if current user is the owner or an ADMIN
    @PostAuthorize("returnObject.username == authentication.principal.username or hasRole('ADMIN')")
    public UserProfile getUserProfile(String requestedUsername) {
        // In a real app, this would fetch from a database
        if ("john.doe".equals(requestedUsername)) {
            return new UserProfile("john.doe", "john@example.com");
        }
        return new UserProfile("guest", "guest@example.com");
    }
}

Running @PostAuthorize Example

This example demonstrates @PostAuthorize. We simulate a UserProfile being returned, and then check if the current authenticated user is allowed to view it.

Notice how the check happens *after* the getUserProfile method has produced its result.

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import java.util.Collections;
import java.util.List;

// Simple data class for demonstration
class UserProfile {
    String username;
    String email;
    public UserProfile(String username, String email) {
        this.username = username;
        this.email = email;
    }
    public String getUsername() { return username; }
    public String getEmail() { return email; }
    @Override
    public String toString() { return "Profile: " + username + " (" + email + ")"; }
}

public class Main {

    // Simulates a service method with @PostAuthorize("returnObject.username == authentication.principal.username")
    public static UserProfile getSecuredUserProfile(String requestedUsername) {
        UserProfile profile = new UserProfile(requestedUsername, requestedUsername + "@example.com");
        
        // Simulate @PostAuthorize check
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth != null && auth.isAuthenticated() && 
            profile.getUsername().equals(auth.getName())) {
            return profile; // Allowed to view own profile
        } else if (auth != null && auth.isAuthenticated() && 
                   auth.getAuthorities().stream().anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"))) {
            return profile; // Admin can view any profile
        } else {
            // In a real app, this would be an AccessDeniedException
            System.out.println("Access Denied to view profile for " + requestedUsername);
            return null; // Or throw an exception
        }
    }

    public static void main(String[] args) {
        // Scenario 1: User viewing their own profile
        List<GrantedAuthority> userAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
        Authentication userAuth = new UsernamePasswordAuthenticationToken("alice", "pass", userAuthorities);
        SecurityContextHolder.getContext().setAuthentication(userAuth);
        System.out.println("Alice viewing her own profile: " + getSecuredUserProfile("alice"));

        // Scenario 2: Alice trying to view Bob's profile
        System.out.println("\nAlice viewing Bob's profile: " + getSecuredUserProfile("bob"));

        // Scenario 3: Admin viewing Bob's profile
        List<GrantedAuthority> adminAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_ADMIN"));
        Authentication adminAuth = new UsernamePasswordAuthenticationToken("admin", "pass", adminAuthorities);
        SecurityContextHolder.getContext().setAuthentication(adminAuth);
        System.out.println("\nAdmin viewing Bob's profile: " + getSecuredUserProfile("bob"));

        SecurityContextHolder.clearContext();
    }
}

Filtering Collections: @PreFilter & @PostFilter

For methods that accept or return collections, Spring Security offers @PreFilter and @PostFilter.

@PreFilter: Filters a collection argument *before* the method executes.
@PostFilter: Filters the returned collection *after* the method executes.

These are powerful for scenarios like showing a user only the items in a list they own, or allowing updates only to specific elements in a batch.

import org.springframework.security.access.prepost.PreFilter;
import org.springframework.security.access.prepost.PostFilter;
import java.util.List;

class Item { String owner; String name; }

public class ItemService {

    // Only allow items owned by the current user to be processed
    @PreFilter("filterObject.owner == authentication.principal.username")
    public void processItems(List<Item> items) {
        // ... process only allowed items ...
    }

    // Only return items owned by the current user
    @PostFilter("filterObject.owner == authentication.principal.username")
    public List<Item> getAllItemsForUser() {
        // ... fetch all items from DB ...
        return List.of(new Item(), new Item()); // Returns filtered list
    }
}

Best Practices for Method Security

To use method-level security effectively:

Apply to Service Layer: Keep business logic separate from controllers. Secure your service methods.
Combine with HttpSecurity: Use URL-based security for broad access control, and method-level for fine-grained permissions. They complement each other.
Keep SpEL Concise: Complex SpEL can be hard to read and debug. Consider custom permission evaluators for very intricate logic.
Test Thoroughly: Always test your security rules to ensure they behave as expected.

Quick Check: Method Annotations

You're building an application and need to ensure that a method public void deleteUser(String userId) can only be called by a user with the ADMIN role, AND only if the userId matches the currently authenticated user's ID.

Which @PreAuthorize expression would correctly enforce this?

Recap & Next Steps

Great job! You've learned about method-level security in Spring Security.

@EnableMethodSecurity activates this feature.
@PreAuthorize checks permissions *before* method execution.
@PostAuthorize checks permissions *after* method execution, inspecting the return value.
@PreFilter and @PostFilter help filter collection arguments or return values.

This powerful tool allows for very precise control over who can access your application's internal operations. Keep practicing and exploring the capabilities of SpEL!

Frequently asked questions

Is the “Method-Level Security with Annotations” lesson free?

Yes — the full text of “Method-Level Security with Annotations” is free to read here on the web, and the Spring Security 6 & JWT Authentication course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Spring Security 6 & JWT Authentication course, upgrade to CoddyKit PRO.

What will I learn in “Method-Level Security with Annotations”?

Secure individual methods in your service layer using Spring Security annotations like `@PreAuthorize` and `@PostAuthorize`. You practise Spring Security 6 & JWT Authentication with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Spring Security 6 & JWT Authentication?

No prior experience is required. Spring Security 6 & JWT Authentication on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Method-Level Security with Annotations” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Spring Security 6 & JWT Authentication lesson?

Yes. Every Spring Security 6 & JWT Authentication lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

Role-Based Access Control (RBAC)
Method-Level Security with Annotations
HttpSecurity Configuration Deep Dive
Securing Endpoints with Custom Access Rules

← Back to Spring Security 6 & JWT Authentication