Spring Security - Third Edition

Securing the business tier

Spring Security has the ability to add a layer of authorization (or authorization-based data pruning) to the invocation of any Spring-managed bean in your application. While many developers focus on web-tier security, business-tier security is arguably just as important, as a malicious user may be able to penetrate the security of your web tier or access services exposed through a non-UI frontend, such as a web service.

Let's examine the following logical diagram to see why we're interested in applying a secondary layer of security:

Spring Security has the following two main techniques for securing methods:

• Preauthorization ...