Method security

@PreAuthorize on a service method checks a rule, such as a role or ownership, before it runs. It protects the operation wherever it is called from, not only through one controller path.

What a session covers

The tutor works through these with you, in conversation and code. A session ends when you have shown them, not when a video does.

Explain what @PreAuthorize checks and where the check runs
Protect a service method with a role and an ownership rule
Spot the operation reachable from a path the URL rules do not cover

In practice

A few lines that show Method security doing its job.

Java

@Configuration
@EnableMethodSecurity
class MethodSecurityConfig {}

@Service
public class ReportService {
    @PreAuthorize("hasRole('ADMIN')")
    public Report exportAll() { ... }

    @PreAuthorize("#ownerId == authentication.name")
    public Report forOwner(String ownerId) { ... }
}

The common mistake

Watch for

Relying only on URL rules while the same service is reachable from another endpoint, a scheduled job or a message listener. Authorise the operation, not just the path.

What to know first

Your roadmap puts these before Method security, unless you already know them.

Authentication providers

How it stays learned

Once a session shows you understand Method security, it comes back for review. Each review takes a minute and tells the memory model how well you still know it.

Day 3First recall, while it is fresh
Day 7Second, a week on
Day 18Last, when it has settled

Previous in the module← Authentication providers