Java Spring Security

Authorization Boundary

Use Spring Security method authorization with @PreAuthorize at the controller boundary for backend or admin access control.

Do not duplicate controller authorization on application services.

Keep services free of Spring Security annotations unless the service itself is exposed as a separate security boundary.

Keep each protected handler's complete capability requirement visible at the method. Do not accidentally make write handlers require read capabilities through shared controller structure. Preserve an explicit project policy for composed/class-level authorization and verify its effective semantics rather than copying another framework's attribute rules.

Ensure method security is actually enabled and invoked through the framework's security interception. Reuse Spring Security configuration; do not build a parallel attribute evaluator or assume annotations alone secure a route.

Authorities And Roles

Prefer direct capability authorities with hasAuthority('SOME_CAPABILITY').

Use plain authority names such as ADMIN_DASHBOARD_VIEW or INSTALLATION_CONTENT_PAGE_MANAGE.