Authorization

🔍 What Is It?

Authorization in Spring Security operates at two levels:

URL-based authorization (SecurityFilterChain)

• →Applied before the request reaches the controller
• →Good for coarse-grained rules (admin paths, public paths)
• →Pattern matching on URL and HTTP method

Method-based authorization (@PreAuthorize, @PostAuthorize)

• →Applied at the method level via AOP proxy
• →Uses Spring Expression Language (SpEL)
• →Can access method parameters and return values
• →More granular than URL-based

Spring Security expressions:

• →hasRole('ADMIN') — has ROLE_ADMIN authority
• →hasAnyRole('USER', 'ADMIN') — has any of these roles
• →hasAuthority('READ_ORDERS') — has specific permission
• →isAuthenticated() — any authenticated user
• →isAnonymous() — unauthenticated user
• →#id == authentication.principal.id — parameter check

🎯 Why Do We Need It?

Without authorization, any authenticated user can access any endpoint. Authorization enforces the principle of least privilege — users only access what they're permitted to. In enterprise apps, this means admins can manage users, regular users can only see their own data, and service accounts have limited scoped access.

🏗️ What Happens in Real Projects?

Enterprise authorization patterns:

• →Role-based: ADMIN, USER, MODERATOR, SUPPORT roles
• →Permission-based: READ_ORDERS, WRITE_ORDERS, DELETE_ORDERS
• →Resource-based: users can only access their own resources
• →Tenant-based: in multi-tenant apps, users only access their tenant's data

⚙️ How It Works

@PreAuthorize is processed by AOP (MethodSecurityInterceptor). Before the method runs, Spring evaluates the SpEL expression with the current Authentication. If it returns false, AccessDeniedException is thrown (403). @PostAuthorize runs after the method and can check the return value.

💻 Example

Authorization Patterns — URL security, method security, and custom authorization.

// URL-based in SecurityConfig
.authorizeHttpRequests(auth -> auth
    .requestMatchers(HttpMethod.GET, "/api/v1/products/**").permitAll()
    .requestMatchers("/api/v1/admin/**").hasRole("ADMIN")
    .requestMatchers("/api/v1/reports/**").hasAnyRole("ADMIN", "ANALYST")
    .requestMatchers(HttpMethod.DELETE).hasRole("ADMIN")  // all DELETE requires ADMIN
    .anyRequest().authenticated()
)

// Method-based in controller/service
@RestController
@RequestMapping("/api/v1/users")
public class UserController {

    @GetMapping
    @PreAuthorize("hasRole('ADMIN')")
    public Page<UserDto> getAllUsers(Pageable pageable) { ... }

    // User can only get their own profile (or admin can get any)
    @GetMapping("/{id}")
    @PreAuthorize("#id == authentication.principal.id or hasRole('ADMIN')")
    public UserDto getUser(@PathVariable Long id) { ... }

    @DeleteMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN')")
    @ResponseStatus(HttpStatus.NO_CONTENT)
    public void deleteUser(@PathVariable Long id) { ... }

    // Check permission on return value
    @GetMapping("/{id}/sensitive")
    @PostAuthorize("returnObject.id == authentication.principal.id or hasRole('ADMIN')")
    public UserDetailDto getSensitiveData(@PathVariable Long id) { ... }
}

🤔 Common Confusions

🚨 Common Production Issues

✅ Best Practices

🏛️ Architect's Note

💬 Frequently Asked Questions

🎯 Key Takeaways

🔗 Related Topics

🎯 Practice this topic in interviews

↗ Where this topic fits