Spring Security - Third Edition

Method security rules incorporating method parameters

Logically, writing rules that refer to method parameters in their constraints seem sensible for certain types of operations. For example, it might make sense for us to restrict the findForUser(int userId) method to meet the following constraints:

• The userId argument must be equal to the current user's ID
• The user must be an administrator (in this case, it is valid for the user to see any event)

While it's easy to see how we could alter the rule to restrict the method invocation only to administrators, it's not clear how we would determine if the user is attempting to change their own password.

Fortunately, SpEL binding, used by the Spring Security method annotations, supports more sophisticated ...