1
0
mirror of synced 2026-08-05 17:57:15 +00:00

SEC-3076: Add Method Level Security Meta Annotations

This commit is contained in:
Rob Winch
2015-08-19 15:39:15 -05:00
parent 7708129aad
commit cbed1d75ee
11 changed files with 358 additions and 1 deletions
+26 -1
View File
@@ -369,7 +369,9 @@ This will give you access to the entire project history (including all releases
[[new]]
== What's new in Spring Security 4.1
* <<test-method-meta-annotations>>
* Meta Annotation Support
** <<test-method-meta-annotations>>
** <<method-security-meta-annotations>>
=== What's new in Spring Security 4.0
@@ -4727,6 +4729,29 @@ To use `hasPermission()` expressions, you have to explicitly configure a `Permis
Where `myPermissionEvaluator` is the bean which implements `PermissionEvaluator`. Usually this will be the implementation from the ACL module which is called`AclPermissionEvaluator`. See the "Contacts" sample application configuration for more details.
===== Method Security Meta Annotations
You can make use of meta annotations for method security to make your code more readable.
This is especially convenient if you find that you are repeating the same complex expression throughout your code base.
For example, consider the following:
[source,java]
----
@PreAuthorize("#contact.name == authentication.name")
----
Instead of repeating this everywhere, we can create a meta annotation that can be used instead.
[source,java]
----
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("#contact.name == authentication.name")
public @interface ContactPermission {}
----
Meta annotations can be used for any of the Spring Security method security annotations.
In order to remain compliant with the specification JSR-250 annotations do not support meta annotations.
[[advanced-topics]]
= Additional Topics
In this part we cover features which require a knowledge of previous chapters as well as some of the more advanced and less-commonly used features of the framework.