Question

It’s not clear for me what is the difference in spring security between :

 @PreAuthorize("hasRole('ROLE_USER')")
 public void create(Contact contact)

And

@Secured("ROLE_USER")
public void create(Contact contact)

I understand PreAuthorize can work with spring el but in my sample, is there a real difference ?

Answer 1

The real difference is that @PreAuthorize can work with Spring Expression Language (SpEL). You can:

• Access methods and properties of SecurityExpressionRoot.

• Access method arguments (requires compilation with debug info or custom ParameterNameDiscoverer):

  @PreAuthorize("#contact.name == principal.name")
  public void doSomething(Contact contact)
  

• (Advanced feature) Add your own methods (override MethodSecurityExpressionHandler and set it as <global-method-security><expression-handler ... /></...>).