Method-level security in Spring Boot - Mini Project: Build & Apply

Method-level Security in Spring Boot

📖 Scenario: You are building a simple Spring Boot application that manages user data. You want to protect certain methods so only users with the right roles can access them.

🎯 Goal: Learn how to add method-level security using Spring Security annotations to restrict access based on user roles.

📋 What You'll Learn

Create a service class with user management methods

Add a configuration variable to enable method security

Use method-level security annotations to restrict access

Complete the security setup to enforce role-based access

💡 Why This Matters

🌍 Real World

Method-level security is used in real applications to protect sensitive operations so only authorized users can perform them.

💼 Career

Understanding method-level security is essential for backend developers working with Spring Boot to build secure applications.

1

Create UserService with methods

Create a class called UserService with two methods: getUser() that returns a string "User data" and deleteUser() that returns a string "User deleted".

Spring Boot

public class UserService {
    // Your code here
}

Hint

Define a public class named UserService. Add two public methods named getUser and deleteUser that return the exact strings.

2

Enable method security in configuration

Create a configuration class called SecurityConfig annotated with @Configuration and @EnableMethodSecurity to enable method-level security.

Spring Boot

public class UserService {
    public String getUser() {
        return "User data";
    }

    public String deleteUser() {
        return "User deleted";
    }
}

// Your code here

Hint

Use @Configuration and @EnableMethodSecurity annotations on a class named SecurityConfig.

3

Add method-level security annotations

In the UserService class, add @PreAuthorize("hasRole('USER')") above the getUser() method and @PreAuthorize("hasRole('ADMIN')") above the deleteUser() method.

Spring Boot

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

@Configuration
@EnableMethodSecurity
public class SecurityConfig {
}

public class UserService {
    // Add @PreAuthorize for getUser
    public String getUser() {
        return "User data";
    }

    // Add @PreAuthorize for deleteUser
    public String deleteUser() {
        return "User deleted";
    }
}

Hint

Import @PreAuthorize and add it above each method with the exact role expressions.

4

Complete security setup with method security enabled

Ensure the SecurityConfig class imports org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity and is annotated with @EnableMethodSecurity to activate method-level security.

Spring Boot

import org.springframework.context.annotation.Configuration;
// Ensure @EnableMethodSecurity is present

@Configuration
// Your code here
public class SecurityConfig {
}

public class UserService {
    @PreAuthorize("hasRole('USER')")
    public String getUser() {
        return "User data";
    }

    @PreAuthorize("hasRole('ADMIN')")
    public String deleteUser() {
        return "User deleted";
    }
}

Hint

Double-check that @EnableMethodSecurity is imported and used on SecurityConfig.

Practice

1. What is the main purpose of using @PreAuthorize in Spring Boot method-level security?

easy

A. To log method execution time

B. To restrict access to a method based on user roles or permissions

C. To automatically retry failed method calls

D. To inject dependencies into a method

Solution

1. Step 1: Understand the role of @PreAuthorize

   @PreAuthorize is an annotation used to secure methods by specifying access rules based on roles or permissions.

2. Step 2: Identify the correct purpose

   It restricts method access to users who meet the specified security expression, such as having a certain role.

3. Final Answer:

   To restrict access to a method based on user roles or permissions -> Option B

4. Quick Check:

   Method-level security = restrict access [OK]

Hint: Remember: @PreAuthorize controls who can call a method [OK]

Common Mistakes:

• Confusing @PreAuthorize with logging or retry mechanisms
• Thinking it injects dependencies
• Assuming it runs code before method execution without security checks

2. Which of the following is the correct syntax to restrict a method to users with role 'ADMIN' using @PreAuthorize?

easy

A. @PreAuthorize("checkRole('ADMIN')")

B. @PreAuthorize("hasPermission('ADMIN')")

C. @PreAuthorize("isUser('ADMIN')")

D. @PreAuthorize("hasRole('ADMIN')")

Solution

1. Step 1: Recall the correct expression for role checking

   The correct Spring Security expression to check a role is hasRole('ROLE_NAME').

2. Step 2: Match the syntax

   @PreAuthorize("hasRole('ADMIN')") uses hasRole('ADMIN'), which is the standard and correct syntax.

3. Final Answer:

   @PreAuthorize("hasRole('ADMIN')") -> Option D

4. Quick Check:

   Role check syntax = hasRole('ROLE') [OK]

Hint: Use hasRole('ROLE') inside @PreAuthorize for role checks [OK]

Common Mistakes:

• Using hasPermission instead of hasRole for roles
• Using non-existent expressions like isUser or checkRole
• Missing quotes or wrong method names

3. Given the method below, what will happen if a user without the 'USER' role calls getUserData()?

@PreAuthorize("hasRole('USER')")
public String getUserData() {
    return "User Data";
}

medium

A. The method returns null

B. The method returns "User Data" normally

C. AccessDeniedException is thrown and method is not executed

D. The method executes but logs a warning

Solution

1. Step 1: Understand the effect of @PreAuthorize with hasRole

   The annotation blocks method execution if the user does not have the required role.

2. Step 2: Identify the behavior when role is missing

   Spring Security throws an AccessDeniedException and prevents the method from running.

3. Final Answer:

   AccessDeniedException is thrown and method is not executed -> Option C

4. Quick Check:

   Missing role = AccessDeniedException [OK]

Hint: No role? Method blocked with AccessDeniedException [OK]

Common Mistakes:

• Thinking method returns null instead of throwing exception
• Assuming method runs but logs warning
• Believing method returns data regardless of role

4. Identify the error in the following method-level security annotation:

@PreAuthorize("hasRole(ADMIN)")
public void deleteUser() {
    // delete logic
}

medium

A. Missing quotes around 'ADMIN' in hasRole expression

B. Method should return a value, not void

C. Annotation should be @PostAuthorize instead of @PreAuthorize

D. No error, the code is correct

Solution

1. Step 1: Check the syntax of hasRole expression

   The role name must be a string inside quotes, like hasRole('ADMIN').

2. Step 2: Identify the missing quotes

   The code uses hasRole(ADMIN) without quotes, causing a syntax error.

3. Final Answer:

   Missing quotes around 'ADMIN' in hasRole expression -> Option A

4. Quick Check:

   Role names need quotes in hasRole [OK]

Hint: Always put role names in quotes inside hasRole() [OK]

Common Mistakes:

• Forgetting quotes around role names
• Confusing @PreAuthorize with @PostAuthorize
• Thinking void methods cannot be secured

5. You want to secure a method so that only users with role 'ADMIN' or with permission 'WRITE_PRIVILEGE' can access it. Which @PreAuthorize expression correctly implements this?

hard

A. @PreAuthorize("hasRole('ADMIN') or hasPermission('WRITE_PRIVILEGE')")

B. @PreAuthorize("hasRole('ADMIN') && hasPermission('WRITE_PRIVILEGE')")

C. @PreAuthorize("hasRole('ADMIN') xor hasPermission('WRITE_PRIVILEGE')")

D. @PreAuthorize("hasRole('ADMIN') and hasPermission('WRITE_PRIVILEGE')")

Solution

1. Step 1: Understand the requirement for access

   The method should allow access if the user has either the 'ADMIN' role or the 'WRITE_PRIVILEGE' permission.

2. Step 2: Choose the correct logical operator

   The logical OR operator or allows access if either condition is true, matching the requirement.

3. Step 3: Verify syntax correctness

   @PreAuthorize("hasRole('ADMIN') or hasPermission('WRITE_PRIVILEGE')") uses or and correct method calls with quotes, making it valid.

4. Final Answer:

   @PreAuthorize("hasRole('ADMIN') or hasPermission('WRITE_PRIVILEGE')") -> Option A

5. Quick Check:

   Use 'or' to allow either role or permission [OK]

Hint: Use 'or' to combine role and permission checks [OK]

Common Mistakes:

• Using 'and' instead of 'or' when either condition suffices
• Using '&&' which is invalid in SpEL expressions
• Confusing xor with or logic