Spring Security - Third Edition

Method security rules incorporating returned values

Just as we were able to leverage the parameters to the method, we can also leverage the returned value of the method call. Let's update the getEvent method to meet the following constraints on the returned value:

• The attendee's ID must be the current user's ID 
• The owner'sID  must be the current user's ID 
• The user must be an administrator (in this case, it is valid for the user to see any event)

Add the following code to the CalendarService interface:

    @PostAuthorize("hasRole('ROLE_ADMIN') or " + "principal.username ==       returnObject.owner.email or " +    "principal.username == returnObject.attendee.email")    Event getEvent(int eventId);

Now, try logging in with the username  [e-mail] ...