November 2017
Intermediate to advanced
542 pages
14h 24m
English
Lastly, we can secure our CalendarService getEvent(int eventId) method with a @PostAuthorize annotation. You will notice that this step is exactly the same as what we did in Chapter 1, Anatomy of an Unsafe Application, and we have only changed the implementation of PermissionEvaluator:
//src/main/java/com/packtpub/springsecurity/service/CalendarService.java @PostAuthorize("hasPermission(returnObject,'read')") Event getEvent(int eventId);
If you have not done so already, restart the application, log in as username/password admin1@example.com/admin1, and visit the Conference Call event (events/101) using the link on the Welcome page. The access denied page will be displayed. However, we would, like ROLE_ADMIN
Read now
Unlock full access