Method security with @PreAuthorize

Key points

• URL rules guard HTTP. Method security guards the method, so the rule holds however the call arrives.
• Enable it with @EnableMethodSecurity. @PreAuthorize and @PostAuthorize work out of the box.
• The older @EnableGlobalMethodSecurity is deprecated — do not reach for it in new code.
• The expression is SpEL. Method arguments (#post), authentication and principal are all in scope.
• It runs through a proxy. A call from inside the same bean, or on a private method, is not checked.
• @PostAuthorize evaluates after the method returns — perfect for ownership checks, wasteful if the work is expensive.

Example

@Configuration
@EnableMethodSecurity
class MethodSecurityConfig { }

@Service
public class PostService {

    @PreAuthorize("hasRole('ADMIN')")
    public void deleteAny(Long id) { ... }

    @PreAuthorize("hasAuthority('post:edit') and #post.authorEmail == authentication.name")
    public Post update(Post post) { ... }

    @PostAuthorize("returnObject.authorEmail == authentication.name")
    public Post findDraft(Long id) { ... }
}

Guard the service method, not only the URL — but remember self-calls bypass the proxy.