iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Spring Security represents both roles and permissions as authorities. With the default role-prefix convention, hasRole("ADMIN") checks for ROLE_ADMIN; hasAuthority("invoice:read") checks for that exact string. Use request rules for broad URL policy and method security for business operations or object-specific decisions.
How roles and authorities differ
An authority is a string granted to an authenticated user and checked by Spring Security. A role is a convention built on that same mechanism: by default, role checks add the ROLE_ prefix. Therefore hasRole("ADMIN") looks for ROLE_ADMIN, while hasAuthority("ROLE_ADMIN") looks for the exact authority ROLE_ADMIN.
Permission-like authorities can use names that describe an action and resource, such as invoice:read, invoice:write, or invoice:approve. hasAuthority compares the supplied value as written. The role prefix is configurable, so the default convention is not an immutable rule; keep the configured prefix and the authority values granted to users consistent.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Restrict HTTP requests with the current Servlet DSL
For Servlet applications, the current reference documents authorizeHttpRequests. Its authorization rules use AuthorizationManager and are applied by AuthorizationFilter. Put more specific matchers before broader ones: request rules are evaluated in declaration order, so an earlier broad matcher can take precedence over a later rule.
#1 Best Overall
@Bean
SecurityFilterChain app(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(authorize -> authorize
.requestMatchers("/admin/**").hasRole("ADMIN")
.requestMatchers(HttpMethod.GET, "/invoices/**").hasAuthority("invoice:read")
.requestMatchers(HttpMethod.POST, "/invoices/**").hasAuthority("invoice:write")
.anyRequest().denyAll()
);
return http.build();
}This illustrates a policy, not a complete application configuration. Configure the authentication mechanisms your application needs, and verify that the matchers reflect the actual routes and intended access. The final denyAll() makes the handling of requests that match no preceding rule explicit. If your application instead needs a different fallback, state that policy deliberately rather than leaving unmatched access implicit.
Where practical, Spring Security recommends type-safe authorization managers instead of SpEL. Expressions can still be useful when they make a policy clearer and the project’s Spring Security version supports the API being used. WebExpressionAuthorizationManager is documented as a migration path for web authorization expressions.
Use method security for operations and object-specific rules
Request rules govern access at the URL and HTTP-method boundary. Method security governs invocation of a method, which is useful when the same operation can be reached from different routes or when a policy depends on method arguments.
Recommended Free Tools
Enable method security in the application, then apply an authorization annotation to the relevant service method. For example, @PreAuthorize("hasAuthority('invoice:approve')") checks authority before the method is invoked. This makes the permission requirement visible at the operation it protects, rather than relying only on a particular controller route.
Rank #3
@PostAuthorize can evaluate a returned object after a method runs. For example, a policy can allow access only when the returned invoice belongs to the authenticated user. The Spring Security documentation describes this pattern as relevant to protection against insecure direct object references. Because the check happens after execution, it does not prevent the underlying read or any side effect that occurred while producing the result. For sensitive reads or operations with side effects, prefer a pre-invocation check or constrain the query itself so unauthorized data is not fetched or acted on.
Choose the enforcement boundary that matches the rule
| Question | Request authorization | Method authorization |
|---|---|---|
| What is protected? | A URL and, when specified, an HTTP method. | A method invocation. |
| What policy context is available? | Request matchers such as paths and HTTP methods. | Method arguments; post-authorization can also inspect the returned object. |
| How does it behave across entry points? | It covers requests that match the configured routes. | It can protect an operation reached through different routes, provided calls pass through the method-security interception. |
| Where is the rule visible? | In the security configuration alongside other route rules. | At the method boundary where the operation is declared. |
| When is it a natural fit? | Broad route policy, such as restricting an administrative URL area or separating read and write endpoints. | Rules tied to a business operation, method inputs, or ownership of a particular object. |
These mechanisms can complement each other: route rules express broad entry-point policy, while method rules protect operations and finer-grained decisions. There is no universal layering prescription for every application. Choose based on how the operation is exposed and what information its rule needs.
Rank #4
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Version context for older configuration examples
Do not mix older examples using authorizeRequests and the legacy Access API with the current authorizeHttpRequests style as though they were interchangeable snippets. The current request-authorization reference describes the latter in terms of AuthorizationManager and AuthorizationFilter.
In the documented Spring Security 7 transition, AccessDecisionManager, AccessDecisionVoter, and related Access API types moved to the legacy spring-security-access module; new applications do not need that dependency. This is a scoped note about that Spring Security 7 change, not a compatibility guide for every historical release. Check the documentation for the specific version used by an existing project before adapting older configuration.
Further reading
For a book-length treatment, Manning’s page for Spring Security in Action, Second Edition by Laurentiu Spilca describes coverage of endpoint-level authorization, request matchers, roles, and authorities. See the publisher’s book page.
Quick Recap
Sources
- Spring Security reference: Authorize HttpServletRequests
- Spring Security reference: Method Security
- Spring Security reference overview
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
