java 47 lines · 7 steps

Method-level authorization with @PreAuthorize in Spring

A Spring REST controller guards each endpoint with a different SpEL security rule via @PreAuthorize.

Explained by highlit

Spring Intermediate authorization spel rest-api security annotations

1@RestController
2@RequestMapping("/api/documents")
3@RequiredArgsConstructor
4public class DocumentController {
5 
  private final DocumentService documentService;
7 
  @GetMapping
  @PreAuthorize("hasAnyRole('USER', 'ADMIN')")
  public List<DocumentDto> list(@AuthenticationPrincipal UserPrincipal principal) {
      return documentService.findAccessibleFor(principal.getId());
  }
13 
  @GetMapping("/{id}")
  @PreAuthorize("@documentSecurity.canRead(#id, authentication)")
  public DocumentDto get(@PathVariable Long id) {
      return documentService.findById(id);
  }
19 
  @PostMapping
  @PreAuthorize("hasRole('EDITOR')")
  public ResponseEntity<DocumentDto> create(@Valid @RequestBody CreateDocumentRequest request,
                                            @AuthenticationPrincipal UserPrincipal principal) {
      DocumentDto created = documentService.create(request, principal.getId());
      return ResponseEntity.status(HttpStatus.CREATED).body(created);
  }
27 
  @PutMapping("/{id}")
  @PreAuthorize("hasRole('EDITOR') and @documentSecurity.isOwner(#id, authentication)")
  public DocumentDto update(@PathVariable Long id,
                            @Valid @RequestBody UpdateDocumentRequest request) {
      return documentService.update(id, request);
  }
34 
  @DeleteMapping("/{id}")
  @PreAuthorize("hasRole('ADMIN')")
  @ResponseStatus(HttpStatus.NO_CONTENT)
  public void delete(@PathVariable Long id) {
      documentService.delete(id);
  }
41 
  @PostMapping("/{id}/publish")
  @PreAuthorize("hasAnyRole('EDITOR', 'ADMIN') and #request.reviewed")
  public DocumentDto publish(@PathVariable Long id, @RequestBody PublishRequest request) {
      return documentService.publish(id);
  }
47}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1@PreAuthorize accepts SpEL, so each endpoint can express its own authorization rule inline.
2Beans like @documentSecurity let you move per-resource ownership checks out of the controller body.
3Combining role checks with method arguments (#id, #request) enables fine-grained, context-aware access control.

Related explainers

java

public class SlidingLogRateLimiter {
 
    private final int maxRequests;
    private final long windowMillis;

How a sliding-log rate limiter works

rate-limiting concurrency sliding-window

Advanced 8 steps

typescript

import { Injectable, UnauthorizedException } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';
import { ConfigService } from '@nestjs/config';

How a JWT strategy authenticates in NestJS

authentication jwt passport

Intermediate 7 steps

java

public final class Slugifier {
 
    private static final Pattern NON_LATIN = Pattern.compile("[^\\w-]");
    private static final Pattern WHITESPACE = Pattern.compile("[\\s]+");

Building a URL slugifier in Java

regex unicode-normalization string-processing

Intermediate 8 steps

package auth
 
import (
	"net/http"

Setting and reading secure session cookies in Go

cookies session-management security

Intermediate 6 steps

java

@Repository
public interface OrderRepository extends JpaRepository<Order, Long> {
 
    @Query("""

Keyset pagination with Spring Data JPA

pagination cursor jpa

Advanced 8 steps

typescript

import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { Reflector } from '@nestjs/core';
import { JwtService } from '@nestjs/jwt';