Method-Level Security
Spring Boot 3.x mein, @EnableMethodSecurity annotation (PEHLE @EnableGlobalMethodSecurity tha, DEPRECATED) EK @Configuration CLASS par LAGAके, @PreAuthorize/@PostAuthorize ANNOTATIONS ko ENABLE kiya jaata hai — INDIVIDUAL SERVICE METHODS par, DIRECT SECURITY RULES APPLY karne ke liye.
@PreAuthorize METHOD EXECUTE hone se PEHLE CHECK karta hai (jaise "HAS ROLE ADMIN?"). @PostAuthorize METHOD EXECUTE hone ke BAAD, RETURN VALUE ko CHECK karta hai — USEFUL jab DECISION, RETURNED OBJECT ki PROPERTIES par DEPEND karta hai (jaise "USER SIRF APNA KHUD KA ORDER dekh sake, DUSRE KA NAHI").
@Configuration
@EnableMethodSecurity
public class MethodSecurityConfig { }
@Service
public class OrderService {
@PreAuthorize("hasRole('ADMIN')")
public void deleteAllOrders() {
// SIRF admin YE method call kar sakta hai
}
@PostAuthorize("returnObject.ownerId == authentication.principal.id or hasRole('ADMIN')")
public Order getOrder(Long orderId) {
// Method EXECUTE hota hai, RETURN VALUE mile jaने ke BAAD, OWNERSHIP CHECK hoती hai
return orderRepository.findById(orderId).orElseThrow();
}
}- @EnableMethodSecurity (Boot 3.x) = @PreAuthorize/@PostAuthorize ko ENABLE karta hai
- @PreAuthorize = method EXECUTE hone se PEHLE check
- @PostAuthorize = RETURN VALUE par based check — data-dependent RULES ke liye
@EnableMethodSecurity (Spring Boot 3.x, PEHLE @EnableGlobalMethodSecurity tha) EK @Configuration class par LAGAके, @PreAuthorize/@PostAuthorize ANNOTATIONS ko ENABLE kiya jaata hai — INDIVIDUAL METHODS par SECURITY RULES APPLY karne ke liye.
@Configuration
@EnableMethodSecurity
public class MethodSecurityConfig { }
@Service
public class AdminService {
@PreAuthorize("hasRole('ADMIN')")
public void deleteUser(Long id) { }
}@PostAuthorize, METHOD EXECUTE hone ke BAAD, RETURN VALUE ko CHECK karta hai — USEFUL jab DECISION, RETURNED OBJECT ki PROPERTIES par DEPEND karta hai (jaise "USER SIRF APNA KHUD KA ORDER dekh sake").
@PostAuthorize("returnObject.ownerId == authentication.principal.id")
public Order getOrder(Long orderId) {
return orderRepository.findById(orderId).orElseThrow();
}