0Pricing
Spring Security 6 & JWT Authentication · Lesson

Role-Based Authorization with Granted Authorities

After authenticating users from a database, learn to authorize them using roles and authorities, securing endpoints and methods in Spring Security.

Role-Based Authorization with Granted Authorities is a free Spring Security 6 & JWT Authentication lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Spring Security 6 & JWT Authentication learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Authentication vs Authorization

You can now load users from a database and verify passwords. That is authentication (who you are). The next question is authorization (what you may do), driven by roles and authorities.

Authorities and Roles

Spring represents permissions as GrantedAuthority objects. A role is just an authority with a ROLE_ prefix, e.g. ROLE_ADMIN.

Assigning Authorities to a User

When building your UserDetails, attach the authorities the user holds.

User.withUsername('alice')
    .password(encoded)
    .roles('ADMIN', 'USER')
    .build();

Securing URLs by Role

In the filter chain, restrict paths with hasRole. Spring adds the ROLE_ prefix for you here.

http.authorizeHttpRequests(a -> a
    .requestMatchers('/admin/**').hasRole('ADMIN')
    .anyRequest().authenticated());

Requiring Specific Authorities

For finer control use hasAuthority, which matches the authority string exactly with no prefix added.

http.authorizeHttpRequests(a -> a
    .requestMatchers('/reports/**').hasAuthority('REPORT_READ'));

Multiple Allowed Roles

hasAnyRole permits access if the user has at least one of several roles.

http.authorizeHttpRequests(a -> a
    .requestMatchers('/staff/**').hasAnyRole('ADMIN', 'MANAGER'));

Method-Level Security

Enable annotation-based security to protect service methods, not just URLs.

@EnableMethodSecurity
@Configuration
public class SecurityConfig { }

Using @PreAuthorize

@PreAuthorize runs a SpEL expression before the method executes, blocking unauthorized callers.

@PreAuthorize("hasRole('ADMIN')")
public void deleteUser(Long id) { }

Checking the Current User

SpEL can reference the authenticated principal, e.g. to allow users to edit only their own data.

@PreAuthorize("#username == authentication.name")
public void updateProfile(String username) { }

Mapping DB Roles to Authorities

In your UserDetailsService, convert role rows from the database into SimpleGrantedAuthority objects so authorization rules apply.

var auths = roles.stream()
    .map(r -> new SimpleGrantedAuthority('ROLE_' + r))
    .toList();

Putting It Together

The full picture: authenticate from the DB, map roles to authorities, secure URLs with hasRole/hasAuthority, and protect methods with @PreAuthorize.

Quick Check

What is the difference between hasRole('ADMIN') and hasAuthority('ADMIN')?

Recap

You can now control what authenticated users may do:

  • Roles are authorities with a ROLE_ prefix
  • hasRole/hasAnyRole vs exact hasAuthority
  • @EnableMethodSecurity + @PreAuthorize for method-level rules
  • Map DB roles to SimpleGrantedAuthority in your UserDetailsService

Frequently asked questions

Is the “Role-Based Authorization with Granted Authorities” lesson free?

Yes — the full text of “Role-Based Authorization with Granted Authorities” is free to read here on the web, and the Spring Security 6 & JWT Authentication course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Spring Security 6 & JWT Authentication course, upgrade to CoddyKit PRO.

What will I learn in “Role-Based Authorization with Granted Authorities”?

After authenticating users from a database, learn to authorize them using roles and authorities, securing endpoints and methods in Spring Security. You practise Spring Security 6 & JWT Authentication with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Spring Security 6 & JWT Authentication?

No prior experience is required. Spring Security 6 & JWT Authentication on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Role-Based Authorization with Granted Authorities” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Spring Security 6 & JWT Authentication lesson?

Yes. Every Spring Security 6 & JWT Authentication lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Custom UserDetailsService Implementation
  2. Understanding Password Encoders
  3. Database User Management Integration
  4. Role-Based Authorization with Granted Authorities
← Back to Spring Security 6 & JWT Authentication