Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesAuthentication establishes who is making a request; authorization determines which endpoints, operations, and records that identity may access. In Spring Security, use request rules for broad route boundaries and method-level checks for decisions tied to a service operation or a specific object. For an API, the usual HTTP distinction is 401 when authentication must be established and 403 when an authenticated caller is denied—but configured handlers control the actual response.
How 401 and 403 differ in Spring Security
In a servlet application, ExceptionTranslationFilter translates security exceptions into HTTP behavior. If the request has no authenticated caller, or authentication fails, Spring invokes an AuthenticationEntryPoint to start authentication. Depending on the application, that can mean an API response, a WWW-Authenticate header, or a redirect to a login page. If an authenticated principal triggers an AccessDeniedException, Spring invokes an AccessDeniedHandler instead. See Spring’s servlet architecture documentation.
As an Amazon Associate I earn from qualifying purchases.
| Request state | Typical API status | Spring Security path |
|---|---|---|
| No authenticated identity, or authentication is required | 401 Unauthorized | AuthenticationEntryPoint starts authentication |
| Identity is authenticated but lacks permission | 403 Forbidden | AccessDeniedHandler handles access denial |
These are practical conventions, not a promise that every application returns the same body, headers, or redirect. The configured entry point and denied handler determine the response details. Spring’s request authorization examples demonstrate the common distinction: an unauthenticated request is unauthorized, while an authenticated user without a required authority is forbidden.
Recommended Free Tools
Why route authorization does not isolate records
URL rules answer broad questions such as whether a caller may use an endpoint or needs a particular authority. They do not, by themselves, answer whether a caller may read invoice 4821 rather than invoice 4822. Spring describes request authorization as coarse-grained and method authorization as a way to enforce finer-grained decisions. Its guidance is to “consider attaching authorization rules to request URIs and methods to begin.” See the Spring Security authorization overview.
#1 Best Overall
For reliable data isolation, put object-sensitive policy close to the service operation that loads or changes the record. An endpoint check can still reject whole classes of requests early, while a service check evaluates the user, operation arguments, or returned object. Review service entry points as well as controllers: authorization that exists only on one route can be bypassed if another code path reaches the same operation.
Keep broad endpoint boundaries in HttpSecurity
Use authorizeHttpRequests for route-level rules. Spring evaluates matcher/rule pairs in the order declared and applies the first matching rule, so put specific routes before broader patterns and finish with an explicit fallback such as .anyRequest().authenticated(). This avoids accidentally leaving a route outside the intended policy.
@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(authorize -> authorize
.requestMatchers("/admin/**").hasRole("ADMIN")
.requestMatchers("/api/**").authenticated()
.anyRequest().authenticated()
);
return http.build();
}This example shows the ordering pattern; adapt matchers and authority names to the application. The key point is to retain a deliberate catch-all rather than assume every endpoint received a specific rule. Spring documents matcher ordering and request authorization in its HttpServletRequest authorization reference.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Enable method security explicitly
Method-level authorization is opt-in. Add @EnableMethodSecurity to configuration to activate annotation support; Spring Boot Starter Security does not enable method-level authorization automatically. The official method security reference covers activation and the available annotations.
@Configuration
@EnableMethodSecurity
class MethodSecurityConfiguration {
}Apply authorization to service methods where the decision belongs to the operation, not just to a controller method. An annotation on one method does not automatically secure neighboring, unannotated methods. Keep request-level coverage as a broad boundary, and review that every sensitive service path is actually covered.
Choose checks according to when the decision is available
Use @PreAuthorize for checks before execution
@PreAuthorize evaluates a condition before the method runs. It can require an authority or compare the authenticated identity with an argument, making it suitable when the needed facts are available before a mutation or retrieval begins.
Rank #4
@PreAuthorize("#owner == authentication.name")
public void updateForOwner(String owner, UpdateRequest request) {
// perform update
}Use argument names and expressions that match the actual method and security configuration. For data updates, a pre-invocation check avoids relying on a decision made only after the method has already changed state.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Use @PostAuthorize when the returned object must be inspected
@PostAuthorize can inspect the method result. Spring’s method security documentation gives an ownership check in this form:
Best Value
@PostAuthorize("returnObject.owner == authentication.name")
public Document findDocument(Long id) {
return repository.findById(id).orElseThrow();
}This is useful when the ownership property is available only on the returned object. Spring specifically identifies @PostAuthorize as helpful against insecure direct object reference. It can prevent an unauthorized value from being returned, but it runs after method execution: do not treat it as a safe guard for a write that may already have committed. Prefer a precondition before mutation. If transaction and security-advisor ordering matter in a particular application, follow the guidance for that project’s Spring Security release. See the method security reference.
Use filters deliberately
@PreFilter can filter method inputs, and @PostFilter can filter returned collections. These annotations can be useful in specific designs, but silently removing elements can produce partial results and obscure an authorization mistake. Choose filtering only when partial results are an intentional part of the service contract.
When Spring Security ACLs make sense
Use the ACL module when permissions vary by individual object and are more complex than a role requirement or a simple owner predicate—for example, when different users receive distinct grants on different records. ACLs model permissions and access-control entries for object instances, can inherit ACLs, and can be evaluated in method-security expressions through AclPermissionEvaluator.
This flexibility adds operational responsibility. The default persistence design uses dedicated tables and JDBC-based services; Spring Security does not automatically create, update, or delete ACL entries when an application performs ordinary DAO or repository operations. Application code must keep ACL records synchronized with the domain objects they govern. Consult the ACL reference before choosing this approach.
| Approach | Best fit | Important consideration |
|---|---|---|
| Request authorization | Route-wide or operation-wide authority boundaries | Matcher order matters; retain a catch-all |
| Method authorization with owner or argument checks | Rules tied to a service operation or a record’s owner | Enable method security and cover each sensitive method |
| ACLs | Distinct, potentially inherited grants on individual objects | Maintain ACL persistence alongside domain operations |
Version and configuration considerations
The Spring Security authorization landing page currently labels its documentation as version 7.1.1 and lists stable releases separately from preview and snapshot releases. The method-security reference linked here is from the 6.5 documentation line. Check the Spring Security version actually used by the project before copying configuration or relying on version-specific details. As of Spring Security 7, the older Access API has moved to the legacy spring-security-access module; new applications do not need that dependency for the current Authorization API. The authorization overview provides the current release context.
Quick Recap
Review the complete authorization path
- Do route matchers cover every relevant endpoint, with specific rules before broad ones and a deliberate fallback?
- Is method security enabled, and does each sensitive service method have the intended check?
- Does the decision happen before a mutation when changing data is at stake?
- Are authentication failures and authenticated denials handled by the intended entry point and access-denied handler?
- If ACLs are used, do domain create, update, and delete operations keep ACL records in sync?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
