0Pricing
Spring Security 6 & JWT Authentication · Lezione

Sicurezza a livello di metodo con le annotazioni

Protegga i singoli metodi del livello di servizio usando annotazioni Spring Security come `@PreAuthorize` e `@PostAuthorize`.

Sicurezza a livello di metodo con le annotazioni è una lezione Spring Security 6 & JWT Authentication gratuita su CoddyKit. Questa è la lezione 2 di 4. Puoi leggere la lezione completa qui gratuitamente — poi esercitati direttamente nel browser con un editor di codice integrato e un tutor IA disponibile 24/7. Fa parte del percorso di apprendimento Spring Security 6 & JWT Authentication, e i tuoi progressi si sincronizzano tra il web e l'app CoddyKit. Il corso Spring Security 6 & JWT Authentication include 4 lezioni in totale.

Parti di questa lezione non sono ancora state tradotte e vengono mostrate in inglese.

Intro to Method Security

Welcome! In Spring Security, we often secure web endpoints using HttpSecurity. But what if you need finer control within your application logic?

Method-level security lets you protect individual methods in your service layer, ensuring only authorized users can call them. This adds another powerful layer of defense!

Enabling Method Security

To use method-level security, you need to enable it in your Spring Security configuration. This is done with the @EnableMethodSecurity annotation.

Place it on your main security configuration class, usually one extending WebSecurityConfigurerAdapter (though in Spring Security 6, you often just use a @Configuration class with a FilterChainBean).

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

@Configuration
@EnableMethodSecurity // Enables @PreAuthorize, @PostAuthorize, etc.
public class SecurityConfig {
    // Your security filter chain bean goes here
}

@PreAuthorize: Before Execution

The @PreAuthorize annotation checks authorization before a method is executed. If the condition isn't met, the method won't run, and an AccessDeniedException is thrown.

It uses Spring Expression Language (SpEL) to define powerful authorization rules. Common uses include checking roles or specific authorities.

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;

@Service
public class AdminService {

    @PreAuthorize("hasRole('ADMIN')")
    public String deleteSensitiveData() {
        return "Sensitive data deleted!";
    }

    @PreAuthorize("hasAuthority('product:write')")
    public String createProduct(String productName) {
        return "Product '" + productName + "' created.";
    }
}

Running @PreAuthorize Example

Let's see @PreAuthorize in action. This runnable example simulates how Spring Security would process the hasRole('ADMIN') check by manually setting a user's role in the security context.

Try running it to see how access is granted or denied based on the assigned role.

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import java.util.Collections;
import java.util.List;

public class Main {

    // This method simulates a service method protected by @PreAuthorize("hasRole('ADMIN')")
    public static String getAdminMessage() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        // In a real Spring app, AOP would handle this check before method entry.
        // We simulate it here for demonstration.
        if (auth != null && auth.getAuthorities().stream()
                .anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"))) {
            return "Welcome, Admin! Here's your secret message.";
        } else {
            return "Access Denied: ADMIN role required.";
        }
    }

    public static void main(String[] args) {
        // Scenario 1: User with ADMIN role
        List<GrantedAuthority> adminAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_ADMIN"));
        Authentication adminAuth = new UsernamePasswordAuthenticationToken("adminUser", "pass", adminAuthorities);
        SecurityContextHolder.getContext().setAuthentication(adminAuth);
        System.out.println("Admin user attempt: " + getAdminMessage());

        // Scenario 2: User with USER role
        List<GrantedAuthority> userAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
        Authentication userAuth = new UsernamePasswordAuthenticationToken("regularUser", "pass", userAuthorities);
        SecurityContextHolder.getContext().setAuthentication(userAuth);
        System.out.println("\nRegular user attempt: " + getAdminMessage());

        SecurityContextHolder.clearContext(); // Clean up
    }
}

SpEL for Dynamic Checks

@PreAuthorize can do more than just check roles! You can use SpEL to access method arguments, the authenticated principal, or even custom beans.

For example, #userId refers to a method parameter named userId. authentication.principal.username gets the current user's username.

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;

@Service
public class UserService {

    // Only allow users to view their own profile
    @PreAuthorize("#userId == authentication.principal.username")
    public String viewUserProfile(String userId) {
        return "Viewing profile for: " + userId;
    }

    // Allow ADMIN or the owner of the resource
    @PreAuthorize("hasRole('ADMIN') or #resourceOwner == authentication.principal.username")
    public String editResource(String resourceId, String resourceOwner) {
        return "Editing resource '" + resourceId + "' by '" + resourceOwner + "'.";
    }
}

@PostAuthorize: After Execution

Sometimes, you need to make an authorization decision after the method has executed and you have access to its return value. This is where @PostAuthorize comes in.

It's useful for ensuring that the authenticated user is allowed to *see* the data that was just retrieved or processed by the method. You can access the return value using returnObject in SpEL.

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;

// A simple data class for demonstration
class UserProfile {
    String username;
    String email;
    public UserProfile(String username, String email) {
        this.username = username;
        this.email = email;
    }
    public String getUsername() { return username; }
    public String getEmail() { return email; }
}

@Service
public class ProfileService {

    // Only allow access to profile if current user is the owner or an ADMIN
    @PostAuthorize("returnObject.username == authentication.principal.username or hasRole('ADMIN')")
    public UserProfile getUserProfile(String requestedUsername) {
        // In a real app, this would fetch from a database
        if ("john.doe".equals(requestedUsername)) {
            return new UserProfile("john.doe", "john@example.com");
        }
        return new UserProfile("guest", "guest@example.com");
    }
}

Running @PostAuthorize Example

This example demonstrates @PostAuthorize. We simulate a UserProfile being returned, and then check if the current authenticated user is allowed to view it.

Notice how the check happens *after* the getUserProfile method has produced its result.

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import java.util.Collections;
import java.util.List;

// Simple data class for demonstration
class UserProfile {
    String username;
    String email;
    public UserProfile(String username, String email) {
        this.username = username;
        this.email = email;
    }
    public String getUsername() { return username; }
    public String getEmail() { return email; }
    @Override
    public String toString() { return "Profile: " + username + " (" + email + ")"; }
}

public class Main {

    // Simulates a service method with @PostAuthorize("returnObject.username == authentication.principal.username")
    public static UserProfile getSecuredUserProfile(String requestedUsername) {
        UserProfile profile = new UserProfile(requestedUsername, requestedUsername + "@example.com");
        
        // Simulate @PostAuthorize check
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth != null && auth.isAuthenticated() && 
            profile.getUsername().equals(auth.getName())) {
            return profile; // Allowed to view own profile
        } else if (auth != null && auth.isAuthenticated() && 
                   auth.getAuthorities().stream().anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"))) {
            return profile; // Admin can view any profile
        } else {
            // In a real app, this would be an AccessDeniedException
            System.out.println("Access Denied to view profile for " + requestedUsername);
            return null; // Or throw an exception
        }
    }

    public static void main(String[] args) {
        // Scenario 1: User viewing their own profile
        List<GrantedAuthority> userAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
        Authentication userAuth = new UsernamePasswordAuthenticationToken("alice", "pass", userAuthorities);
        SecurityContextHolder.getContext().setAuthentication(userAuth);
        System.out.println("Alice viewing her own profile: " + getSecuredUserProfile("alice"));

        // Scenario 2: Alice trying to view Bob's profile
        System.out.println("\nAlice viewing Bob's profile: " + getSecuredUserProfile("bob"));

        // Scenario 3: Admin viewing Bob's profile
        List<GrantedAuthority> adminAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_ADMIN"));
        Authentication adminAuth = new UsernamePasswordAuthenticationToken("admin", "pass", adminAuthorities);
        SecurityContextHolder.getContext().setAuthentication(adminAuth);
        System.out.println("\nAdmin viewing Bob's profile: " + getSecuredUserProfile("bob"));

        SecurityContextHolder.clearContext();
    }
}

Filtering Collections: @PreFilter & @PostFilter

For methods that accept or return collections, Spring Security offers @PreFilter and @PostFilter.

  • @PreFilter: Filters a collection argument *before* the method executes.
  • @PostFilter: Filters the returned collection *after* the method executes.

These are powerful for scenarios like showing a user only the items in a list they own, or allowing updates only to specific elements in a batch.

import org.springframework.security.access.prepost.PreFilter;
import org.springframework.security.access.prepost.PostFilter;
import java.util.List;

class Item { String owner; String name; }

public class ItemService {

    // Only allow items owned by the current user to be processed
    @PreFilter("filterObject.owner == authentication.principal.username")
    public void processItems(List<Item> items) {
        // ... process only allowed items ...
    }

    // Only return items owned by the current user
    @PostFilter("filterObject.owner == authentication.principal.username")
    public List<Item> getAllItemsForUser() {
        // ... fetch all items from DB ...
        return List.of(new Item(), new Item()); // Returns filtered list
    }
}

Best Practices for Method Security

To use method-level security effectively:

  • Apply to Service Layer: Keep business logic separate from controllers. Secure your service methods.
  • Combine with HttpSecurity: Use URL-based security for broad access control, and method-level for fine-grained permissions. They complement each other.
  • Keep SpEL Concise: Complex SpEL can be hard to read and debug. Consider custom permission evaluators for very intricate logic.
  • Test Thoroughly: Always test your security rules to ensure they behave as expected.

Quick Check: Method Annotations

You're building an application and need to ensure that a method public void deleteUser(String userId) can only be called by a user with the ADMIN role, AND only if the userId matches the currently authenticated user's ID.

Which @PreAuthorize expression would correctly enforce this?

Recap & Next Steps

Great job! You've learned about method-level security in Spring Security.

  • @EnableMethodSecurity activates this feature.
  • @PreAuthorize checks permissions *before* method execution.
  • @PostAuthorize checks permissions *after* method execution, inspecting the return value.
  • @PreFilter and @PostFilter help filter collection arguments or return values.

This powerful tool allows for very precise control over who can access your application's internal operations. Keep practicing and exploring the capabilities of SpEL!

Domande Frequenti

La lezione «Sicurezza a livello di metodo con le annotazioni» è gratuita?

Sì — il testo completo di «Sicurezza a livello di metodo con le annotazioni» è gratuito qui sul web. Per esercitarvi in modo interattivo (un editor di codice integrato e un tutor IA 24/7) e sbloccare il resto del corso Spring Security 6 & JWT Authentication, passa a CoddyKit PRO. Il corso Spring Security 6 & JWT Authentication include 4 lezioni in totale.

Cosa imparerò in «Sicurezza a livello di metodo con le annotazioni»?

Protegga i singoli metodi del livello di servizio usando annotazioni Spring Security come `@PreAuthorize` e `@PostAuthorize`. Eserciti Spring Security 6 & JWT Authentication con codice pratico che esegui direttamente nel browser, e un tutor IA 24/7 risponde alle tue domande mentre lavori sulla lezione.

Ho bisogno di esperienza per iniziare Spring Security 6 & JWT Authentication?

Non è richiesta alcuna esperienza precedente. Spring Security 6 & JWT Authentication su CoddyKit è strutturato per principianti e studenti avanzati, quindi puoi iniziare da qui o dall'inizio e procedere al tuo ritmo. Questa è la lezione 2 di 4.

Quanto tempo richiede la lezione «Sicurezza a livello di metodo con le annotazioni»?

La maggior parte delle lezioni CoddyKit richiede circa 5–10 minuti. Ogni lezione è breve e interattiva, quindi fai progressi costanti e riprendi esattamente da dove hai lasciato su web e app.

Posso scrivere ed eseguire codice in questa lezione Spring Security 6 & JWT Authentication?

Sì. Ogni lezione Spring Security 6 & JWT Authentication include un editor di codice integrato, quindi scrivi ed esegui codice reale direttamente nel tuo browser e ricevi feedback istantaneo dall'IA — nessuna configurazione locale necessaria.

Tutte le lezioni di questo corso

  1. Controllo degli accessi basato sui ruoli (RBAC)
  2. Sicurezza a livello di metodo con le annotazioni
  3. Approfondimento della configurazione di HttpSecurity
  4. Proteggere gli endpoint con regole di accesso personalizzate
← Torna a Spring Security 6 & JWT Authentication