@Secured annotation in Spring Boot - Performance & Optimization

Performance: @Secured annotation

MEDIUM IMPACT

This annotation affects server-side request handling speed and security checks, impacting response time and user interaction delay.

Securing methods with role-based access control

Spring Boot

@Secured("ROLE_ADMIN")
public void process() {
  // method logic
}

Restricting to a single role reduces the number of security checks, improving request handling speed.

📈 Performance Gainreduces security check overhead, improving INP slightly

Securing methods with role-based access control

Spring Boot

@Secured({"ROLE_ADMIN", "ROLE_USER"})
public void process() {
  // method logic
}

Using @Secured with multiple roles causes Spring Security to check if the user has any one of the roles, which may add overhead per request.

📉 Performance Costadds small processing delay per request due to multiple role checks

Performance Comparison

Pattern	Security Checks	Request Delay	User Interaction Delay	Verdict
Multiple roles in @Secured	Multiple role checks	Increased by ~1-3ms	Slightly higher INP	[!] OK
Single role in @Secured	Single role check	Minimal delay	Better INP	[OK] Good

Rendering Pipeline

When a secured method is called, Spring Security intercepts the call to verify roles before executing the method logic. This adds a security check stage before business logic execution.

→Request Handling

→Security Interception

→Method Execution

⚠️ BottleneckSecurity Interception stage due to role verification

Core Web Vital Affected

INP

This annotation affects server-side request handling speed and security checks, impacting response time and user interaction delay.

Optimization Tips

1Minimize the number of roles specified in @Secured to reduce security check overhead.

2Cache security context to avoid repeated role verification on each request.

3Use server-side security checks efficiently to maintain good interaction responsiveness (INP).

Performance Quiz - 3 Questions

How does using multiple roles in @Secured affect request handling?

A It has no effect on performance

B It increases the number of security checks, adding slight delay

C It reduces security checks and speeds up requests

D It blocks rendering on the client side

DevTools: Network and Performance panels

How to check: Use Network panel to measure response time; use Performance panel to record and analyze request handling and interaction delays.

What to look for: Look for increased server response time and longer interaction to next paint (INP) when multiple roles are checked.

Practice

1.

What is the main purpose of the @Secured annotation in Spring Boot?

easy

A. To restrict access to methods based on user roles

B. To define database entity relationships

C. To configure application properties

D. To handle HTTP request mappings

Solution

1. Step 1: Understand the role of @Secured

   The @Secured annotation is used to limit method access to users with specific roles.

2. Step 2: Compare with other options

   Other options relate to different Spring features like database or HTTP handling, not security roles.

3. Final Answer:

   To restrict access to methods based on user roles -> Option A

4. Quick Check:

   @Secured controls method access by roles [OK]

Hint: Remember: @Secured controls who can run a method [OK]

Common Mistakes:

• Confusing @Secured with @RequestMapping
• Thinking @Secured configures database
• Assuming @Secured manages app properties

2.

Which of the following is the correct way to use @Secured to allow only users with role ADMIN to access a method?

@Secured({"?"})
public void adminMethod() { }

easy

A. ROLE_ADMIN

B. ADMIN

C. ROLE-ADMIN

D. ROLE_ADMINISTRATOR

Solution

1. Step 1: Recall role naming convention

   Spring Security requires roles to be prefixed with ROLE_, so ROLE_ADMIN is correct.

2. Step 2: Check other options

   ADMIN without prefix is invalid; ROLE-ADMIN uses wrong separator; ROLE_ADMINISTRATOR is a different role.

3. Final Answer:

   ROLE_ADMIN -> Option A

4. Quick Check:

   Roles need ROLE_ prefix [OK]

Hint: Always prefix roles with ROLE_ inside @Secured [OK]

Common Mistakes:

• Omitting ROLE_ prefix
• Using dash (-) instead of underscore (_)
• Using wrong role names

3.

Given this method secured with @Secured({"ROLE_USER", "ROLE_ADMIN"}), what happens if a user with role ROLE_GUEST calls it?

@Secured({"ROLE_USER", "ROLE_ADMIN"})
public String getData() {
    return "Secret Data";
}

medium

A. The method executes and returns "Secret Data"

B. The method executes but returns empty string

C. The method returns null

D. Access denied error is thrown

Solution

1. Step 1: Understand role checking with @Secured

   The annotation allows only users with roles ROLE_USER or ROLE_ADMIN.

2. Step 2: Check user role

   User has ROLE_GUEST, which is not allowed, so access is denied.

3. Final Answer:

   Access denied error is thrown -> Option D

4. Quick Check:

   User role mismatch causes denial [OK]

Hint: Only listed roles can access; others get denied [OK]

Common Mistakes:

• Assuming method runs for any role
• Thinking method returns null on denial
• Confusing role names

4.

Identify the error in this usage of @Secured:

@Secured("ROLE_ADMIN")
public void adminTask() { }

medium

A. Role name should not have ROLE_ prefix

B. Missing curly braces around roles array

C. Method must return a value

D. Annotation should be @RolesAllowed instead

Solution

1. Step 1: Check @Secured syntax

   @Secured expects an array of roles, so roles must be inside curly braces {}.

2. Step 2: Analyze given code

   Here, roles are given as a single string without braces, causing syntax error.

3. Final Answer:

   Missing curly braces around roles array -> Option B

4. Quick Check:

   @Secured requires roles in braces [OK]

Hint: Always use braces {} for roles in @Secured [OK]

Common Mistakes:

• Omitting braces for single role
• Removing ROLE_ prefix
• Confusing @Secured with @RolesAllowed

5.

You want to secure two methods: one accessible only by ROLE_ADMIN, and another accessible by either ROLE_USER or ROLE_MANAGER. Which is the correct way to annotate these methods?

Method 1:
@Secured({"?"})
public void adminOnly() { }

Method 2:
@Secured({"?"})
public void userOrManager() { }

hard

A. {"ROLE_ADMIN"} and {"ROLE_USER|ROLE_MANAGER"}

B. {"ADMIN"} and {"USER", "MANAGER"}

C. {"ROLE_ADMIN"} and {"ROLE_USER", "ROLE_MANAGER"}

D. {"ROLE_ADMIN", "ROLE_USER"} and {"ROLE_MANAGER"}

Solution

1. Step 1: Secure Method 1 for ROLE_ADMIN only

   Use @Secured({"ROLE_ADMIN"}) to restrict access to admins.

2. Step 2: Secure Method 2 for ROLE_USER or ROLE_MANAGER

   Use @Secured({"ROLE_USER", "ROLE_MANAGER"}) to allow either role.

3. Final Answer:

   {"ROLE_ADMIN"} and {"ROLE_USER", "ROLE_MANAGER"} -> Option C

4. Quick Check:

   Use arrays with ROLE_ prefix for multiple roles [OK]

Hint: Use arrays with ROLE_ prefix for each method [OK]

Common Mistakes:

• Omitting ROLE_ prefix
• Using pipe '|' inside role strings
• Mixing roles in one annotation incorrectly