Spring: Developing Java Applications for the Enterprise

Method-level security

This is an alternative to securing URL access in the web layer. Sometimes, it is also required to secure method invocation in the service layer by enforcing fine-grained security control on methods. This is because, sometimes, it's easier to control it on particular methods than filtering by address, which can be called by typing. We can secure method invocation using Spring Security in a declarative way. We can annotate methods declaration in a bean interface or its implementation class with @Secured annotation and specify the access attributes as its value whose type is String[], and enable security for these annotated methods by adding <global-method-security> in Spring-Security.xml file. This can be done as follows: