How does method security work?
The access decision mechanism for method security—whether or not a given request is allowed—is conceptually the same as the access decision logic for web request access. AccessDecisionManager polls a set of AccessDecisionVoters, each of which can provide a decision to grant or deny access, or abstain from voting. The specific implementation of AccessDecisionManager aggregates the voter decisions and arrives at an overall decision to allow for the method invocation.
Web request access decision making is less complicated, due to the fact that the availability of servlet filters makes interception (and summary rejection) of securable requests relatively straightforward. As method invocation can happen from anywhere, ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access