Spring 5.0 Projects

Method-level resource permissions

Now, an authorized user can access all of the resources that we have configured. How good would it be if the resources could be accessed based on user roles? It would provide for more fine-grained control over the resources. This is possible by applying method-level configurations in Spring Security. For this, first, we need to define a class that represents method-level Spring Security configurations, as follows:

@Configuration@EnableGlobalMethodSecurity(prePostEnabled = true,securedEnabled = true)public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {  @Override  protected MethodSecurityExpressionHandler createExpressionHandler() { return new OAuth2MethodSecurityExpressionHandler(); ...