Custom permission evaluator in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a Custom Permission Evaluator in Spring Security?

A Custom Permission Evaluator is a class that implements Spring Security's PermissionEvaluator interface to define fine-grained access control logic beyond simple role checks.

beginner

Which interface must you implement to create a Custom Permission Evaluator?

You must implement the PermissionEvaluator interface, which requires defining the methods hasPermission(Authentication, Object, Object) and hasPermission(Authentication, Serializable, String, Object).

intermediate

How does Spring Security use a Custom Permission Evaluator in method security?

Spring Security calls the hasPermission methods of your Custom Permission Evaluator when you use expressions like @PreAuthorize("hasPermission(...)") to decide if access should be granted.

intermediate

What are the two main methods you must override in a Custom Permission Evaluator?

The two methods are: hasPermission(Authentication authentication, Object targetDomainObject, Object permission) and hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission).

intermediate

Why would you use a Custom Permission Evaluator instead of simple role-based checks?

Because it allows you to check permissions based on the actual domain object or context, enabling more precise and flexible security rules than just checking user roles.

Which interface do you implement to create a Custom Permission Evaluator in Spring Security?

A AuthenticationProvider

B UserDetailsService

C AccessDecisionVoter

D PermissionEvaluator

The PermissionEvaluator interface defines methods for custom permission checks.

What annotation commonly uses hasPermission expressions to invoke a Custom Permission Evaluator?

A @PreAuthorize

B @Controller

C @Service

D @Entity

@PreAuthorize allows method-level security using expressions like hasPermission.

Which method signature is NOT part of the PermissionEvaluator interface?

A hasPermission(Authentication, Object, Object)

B hasPermission(Authentication, String, Object)

C hasPermission(Authentication, Serializable, String, Object)

D None of the above

The interface does not have a method with signature hasPermission(Authentication, String, Object).

What does the 'targetDomainObject' parameter represent in hasPermission method?

A The HTTP request

B The user's role

C The domain object to check permission against

D The authentication token

'targetDomainObject' is the object on which permission is checked.

Why is a Custom Permission Evaluator useful?

A To implement complex, object-level security rules

B To replace the entire Spring Security framework

C To manage database connections

D To handle user login forms

It allows fine-grained control over access based on domain objects.

Explain how to create and use a Custom Permission Evaluator in Spring Security.

Think about the interface, methods, and how Spring Security calls it.

Describe the difference between role-based access control and permission evaluation with a Custom Permission Evaluator.

Consider the level of detail in access decisions.