Spring Security 6 & JWT Authentication · Lesson

Role-Based Access Control (RBAC)

Implement role-based authorization to restrict access to specific resources based on user roles and permissions.

Role-Based Access Control (RBAC) is a free Spring Security 6 & JWT Authentication lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Spring Security 6 & JWT Authentication learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Understanding RBAC Basics

Welcome! Today we'll dive into Role-Based Access Control (RBAC). It's a fundamental security concept for managing who can do what in an application.

Imagine a school: students can view grades, teachers can post grades, and administrators can manage all users. Each group has a 'role' with specific 'permissions'.

Role: A collection of permissions.
Permission: The ability to perform a specific action (e.g., read, write, delete).

Roles in Spring Security

Spring Security uses roles to enforce authorization. When you define a user, you also assign them one or more roles.

Internally, Spring Security treats roles as Granted Authorities. By convention, roles are often prefixed with ROLE_ (e.g., ROLE_ADMIN, ROLE_USER). This helps distinguish them from other types of authorities.

Assigning Roles to Users

Before we can use RBAC, users need roles! When a user logs in, Spring Security's authentication process retrieves their assigned roles.

These roles are typically loaded from a database via a UserDetailsService, or for simpler cases, defined directly in memory. We'll use in-memory users for our examples to keep things clear.

Securing URLs with `hasRole()`

The core of RBAC in Spring Security for web applications is configuring HttpSecurity. We use methods like hasRole() to specify which roles can access certain URL patterns.

For example, to protect an 'admin' page, you might write: .requestMatchers("/admin/**").hasRole("ADMIN"). Spring Security automatically adds the ROLE_ prefix when you use hasRole().

RBAC Web Security Config

Let's see a simple Spring Security configuration. This setup defines two in-memory users (user and admin) and secures two endpoints: /user and /admin.

Try running this code and accessing the URLs!

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class Main {

  public static void main(String[] args) {
    SpringApplication.run(Main.class, args);
  }

  @GetMapping("/user")
  public String userEndpoint() {
    return "Hello, User!";
  }

  @GetMapping("/admin")
  public String adminEndpoint() {
    return "Hello, Admin!";
  }

  @Configuration
  @EnableWebSecurity
  static class WebSecurityConfig {

    @Bean
    public UserDetailsService userDetailsService() {
      UserDetails user = User.withDefaultPasswordEncoder()
          .username("user")
          .password("password")
          .roles("USER")
          .build();
      UserDetails admin = User.withDefaultPasswordEncoder()
          .username("admin")
          .password("password")
          .roles("ADMIN", "USER")
          .build();
      return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
      http
          .authorizeHttpRequests(authorize -> authorize
              .requestMatchers("/user/**").hasRole("USER")
              .requestMatchers("/admin/**").hasRole("ADMIN")
              .anyRequest().authenticated()
          )
          .formLogin(org.springframework.security.config.Customizer.withDefaults());
      return http.build();
    }
  }
}

Testing Our RBAC Setup

After running the previous example, open your browser and try to access these URLs:

http://localhost:8080/user: Log in with user/password or admin/password. Both should work!
http://localhost:8080/admin: Log in with admin/password. This should work.
http://localhost:8080/admin: Log in with user/password. You should see an 'Access Denied' error (403 Forbidden).

This demonstrates how roles restrict access!

Multiple Roles: `hasAnyRole()`

What if an endpoint can be accessed by more than one role? Spring Security provides hasAnyRole() for this.

Instead of listing multiple hasRole() calls, you can do: .requestMatchers("/dashboard/**").hasAnyRole("USER", "ADMIN"). This grants access if the authenticated user has EITHER the USER role OR the ADMIN role.

`hasRole()` vs `hasAuthority()`

You might also see hasAuthority() being used. What's the difference?

hasRole("ADMIN"): This implicitly adds the ROLE_ prefix, so it checks for ROLE_ADMIN.
hasAuthority("ROLE_ADMIN"): This requires the exact authority string, including the ROLE_ prefix if it's part of the authority name.

Generally, hasRole() is preferred for clarity when dealing with roles defined with the ROLE_ prefix.

Securing Specific HTTP Methods

RBAC can also be applied to specific HTTP methods for a given path. This is useful for REST APIs where different actions (GET, POST, PUT, DELETE) require different permissions.

You can chain requestMatchers() with HttpMethod:

.requestMatchers(HttpMethod.POST, "/products/**").hasRole("ADMIN")
.requestMatchers(HttpMethod.GET, "/products/**").hasAnyRole("USER", "ADMIN")

Here, only ADMIN can create products, but both USER and ADMIN can view them.

Best Practices for RBAC

To make RBAC effective and manageable:

Keep Roles Simple: Don't create too many roles. Roles should represent distinct job functions.
Least Privilege: Grant only the necessary roles/permissions to users.
Centralized Management: Manage roles and their assignments from a single, secure place.
Audit Regularly: Periodically review role assignments and permissions to ensure they are still appropriate.

RBAC Knowledge Check

You've learned about implementing Role-Based Access Control in Spring Security. Let's quickly test your understanding!

Recap: Role-Based Access Control

Great job! In this lesson, you learned about:

What RBAC is and its importance for authorization.
How Spring Security uses roles (as GrantedAuthority).
Configuring URL-based RBAC with HttpSecurity.
Using hasRole() and hasAnyRole() to protect endpoints.
Distinguishing between hasRole() and hasAuthority().
Applying RBAC to specific HTTP methods.
Key best practices for effective RBAC implementation.

You now have a solid foundation for controlling access based on user roles!

Frequently asked questions

Is the “Role-Based Access Control (RBAC)” lesson free?

Yes — the full text of “Role-Based Access Control (RBAC)” is free to read here on the web, and the Spring Security 6 & JWT Authentication course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Spring Security 6 & JWT Authentication course, upgrade to CoddyKit PRO.

What will I learn in “Role-Based Access Control (RBAC)”?

Implement role-based authorization to restrict access to specific resources based on user roles and permissions. You practise Spring Security 6 & JWT Authentication with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Spring Security 6 & JWT Authentication?

No prior experience is required. Spring Security 6 & JWT Authentication on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Role-Based Access Control (RBAC)” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Spring Security 6 & JWT Authentication lesson?

Yes. Every Spring Security 6 & JWT Authentication lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

Role-Based Access Control (RBAC)
Method-Level Security with Annotations
HttpSecurity Configuration Deep Dive
Securing Endpoints with Custom Access Rules

← Back to Spring Security 6 & JWT Authentication