Authorization in Spring Security: permissions, roles and beyond
summary
Live-coded Spring Boot app shows concrete patterns: request-level rules with AuthorizationManager lambdas, method-level checks via preAuthorize/postAuthorize and SPEL, and object-level proxies that redact fields by returning a proxy-wrapped domain object. Demonstrates a reusable @AllowedDomains annotation (uses Spring Security 6.3 template expressions), a handle-authorization-denied bean to return null/redacted instead of 403, a custom authentication detail source to record login type, and separate security filter chains for HTTP Basic APIs — all working end-to-end.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:50Why authorization focus
- 3:14Demo setup
- 8:07Request-level mechanics
- 13:46Advanced authorization rules
- 18:03Key takeaways
- 19:07Method-level with pre-authorize
- 21:56Post-authorize decisions
- 23:20Custom security annotations
- 27:15Handling denied access
- 29:00Object-level security
- 33:19Authorization design
- 36:52Authentication context
- 41:10Custom auth details
- 45:03Custom filter chains
- 48:18Authorization context
- 48:38Splitting filter chains
- 49:20Closing remarks
related talks
02h 38mAuthorization with Spring Security: Permissions, Roles and More
33mSpring Security Patterns
54mSpring Security Patterns
52mArchitecture Deep Dive in Spring Security
51mAuthorization beyond @RolesAllowed
46mEverything new in Spring Security 6 baked with a Spring Boot3 recipe
40mSpring Security 6: The Next Generation
45mSpring Security: The Good Parts