@Secured annotation in Spring Boot - Mini Project: Build & Apply

Using @Secured Annotation in Spring Boot

📖 Scenario: You are building a simple Spring Boot web application that has different user roles. You want to protect certain methods so that only users with specific roles can access them.

🎯 Goal: Learn how to use the @Secured annotation to restrict access to methods based on user roles in a Spring Boot application.

📋 What You'll Learn

Create a Spring Boot service class with a method to secure

Add a configuration to enable method security

Use the @Secured annotation to restrict method access to a specific role

Create a simple controller to call the secured method

💡 Why This Matters

🌍 Real World

Many web applications need to restrict access to certain features based on user roles. Using @Secured helps enforce these rules easily at the method level.

💼 Career

Understanding method-level security with @Secured is essential for backend developers working with Spring Boot to build secure applications.

1

Create a service class with a method

Create a Spring service class called MyService with a public method getSecretMessage() that returns the string "Secret Info".

Spring Boot

import org.springframework.stereotype.Service;

@Service
public class MyService {
    // Your code here
}

Hint

Use @Service annotation and create a method that returns the exact string.

2

Enable method security in configuration

Create a configuration class called SecurityConfig annotated with @Configuration and @EnableMethodSecurity to enable method-level security.

Spring Boot

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

@Configuration
@EnableMethodSecurity
public class SecurityConfig {
    // Your code here
}

Hint

Use @EnableMethodSecurity on a configuration class to activate method security.

3

Add @Secured annotation to restrict access

Modify the getSecretMessage() method in MyService to add the @Secured annotation that allows access only to users with the role ROLE_ADMIN.

Spring Boot

import org.springframework.security.access.annotation.Secured;

@Service
public class MyService {
    @Secured({"ROLE_ADMIN"})
    public String getSecretMessage() {
        return "Secret Info";
    }
}

// SecurityConfig class remains unchanged

Hint

Import @Secured and add it above the method with the role ROLE_ADMIN inside curly braces.

4

Create a controller to call the secured method

Create a Spring REST controller class called MyController with a GET endpoint /secret that calls getSecretMessage() from MyService and returns its result.

Spring Boot

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.beans.factory.annotation.Autowired;

@RestController
public class MyController {
    @Autowired
    private MyService myService;

    @GetMapping("/secret")
    public String secret() {
        // Your code here
    }
}

Hint

Inject MyService using @Autowired and return the secured method's result in the GET endpoint.

Practice

1.

What is the main purpose of the @Secured annotation in Spring Boot?

easy

A. To restrict access to methods based on user roles

B. To define database entity relationships

C. To configure application properties

D. To handle HTTP request mappings

Solution

1. Step 1: Understand the role of @Secured

   The @Secured annotation is used to limit method access to users with specific roles.

2. Step 2: Compare with other options

   Other options relate to different Spring features like database or HTTP handling, not security roles.

3. Final Answer:

   To restrict access to methods based on user roles -> Option A

4. Quick Check:

   @Secured controls method access by roles [OK]

Hint: Remember: @Secured controls who can run a method [OK]

Common Mistakes:

• Confusing @Secured with @RequestMapping
• Thinking @Secured configures database
• Assuming @Secured manages app properties

2.

Which of the following is the correct way to use @Secured to allow only users with role ADMIN to access a method?

@Secured({"?"})
public void adminMethod() { }

easy

A. ROLE_ADMIN

B. ADMIN

C. ROLE-ADMIN

D. ROLE_ADMINISTRATOR

Solution

1. Step 1: Recall role naming convention

   Spring Security requires roles to be prefixed with ROLE_, so ROLE_ADMIN is correct.

2. Step 2: Check other options

   ADMIN without prefix is invalid; ROLE-ADMIN uses wrong separator; ROLE_ADMINISTRATOR is a different role.

3. Final Answer:

   ROLE_ADMIN -> Option A

4. Quick Check:

   Roles need ROLE_ prefix [OK]

Hint: Always prefix roles with ROLE_ inside @Secured [OK]

Common Mistakes:

• Omitting ROLE_ prefix
• Using dash (-) instead of underscore (_)
• Using wrong role names

3.

Given this method secured with @Secured({"ROLE_USER", "ROLE_ADMIN"}), what happens if a user with role ROLE_GUEST calls it?

@Secured({"ROLE_USER", "ROLE_ADMIN"})
public String getData() {
    return "Secret Data";
}

medium

A. The method executes and returns "Secret Data"

B. The method executes but returns empty string

C. The method returns null

D. Access denied error is thrown

Solution

1. Step 1: Understand role checking with @Secured

   The annotation allows only users with roles ROLE_USER or ROLE_ADMIN.

2. Step 2: Check user role

   User has ROLE_GUEST, which is not allowed, so access is denied.

3. Final Answer:

   Access denied error is thrown -> Option D

4. Quick Check:

   User role mismatch causes denial [OK]

Hint: Only listed roles can access; others get denied [OK]

Common Mistakes:

• Assuming method runs for any role
• Thinking method returns null on denial
• Confusing role names

4.

Identify the error in this usage of @Secured:

@Secured("ROLE_ADMIN")
public void adminTask() { }

medium

A. Role name should not have ROLE_ prefix

B. Missing curly braces around roles array

C. Method must return a value

D. Annotation should be @RolesAllowed instead

Solution

1. Step 1: Check @Secured syntax

   @Secured expects an array of roles, so roles must be inside curly braces {}.

2. Step 2: Analyze given code

   Here, roles are given as a single string without braces, causing syntax error.

3. Final Answer:

   Missing curly braces around roles array -> Option B

4. Quick Check:

   @Secured requires roles in braces [OK]

Hint: Always use braces {} for roles in @Secured [OK]

Common Mistakes:

• Omitting braces for single role
• Removing ROLE_ prefix
• Confusing @Secured with @RolesAllowed

5.

You want to secure two methods: one accessible only by ROLE_ADMIN, and another accessible by either ROLE_USER or ROLE_MANAGER. Which is the correct way to annotate these methods?

Method 1:
@Secured({"?"})
public void adminOnly() { }

Method 2:
@Secured({"?"})
public void userOrManager() { }

hard

A. {"ROLE_ADMIN"} and {"ROLE_USER|ROLE_MANAGER"}

B. {"ADMIN"} and {"USER", "MANAGER"}

C. {"ROLE_ADMIN"} and {"ROLE_USER", "ROLE_MANAGER"}

D. {"ROLE_ADMIN", "ROLE_USER"} and {"ROLE_MANAGER"}

Solution

1. Step 1: Secure Method 1 for ROLE_ADMIN only

   Use @Secured({"ROLE_ADMIN"}) to restrict access to admins.

2. Step 2: Secure Method 2 for ROLE_USER or ROLE_MANAGER

   Use @Secured({"ROLE_USER", "ROLE_MANAGER"}) to allow either role.

3. Final Answer:

   {"ROLE_ADMIN"} and {"ROLE_USER", "ROLE_MANAGER"} -> Option C

4. Quick Check:

   Use arrays with ROLE_ prefix for multiple roles [OK]

Hint: Use arrays with ROLE_ prefix for each method [OK]

Common Mistakes:

• Omitting ROLE_ prefix
• Using pipe '|' inside role strings
• Mixing roles in one annotation incorrectly