CustomMethodSecurityExpressionHandler

CustomMethodSecurityExpressionHandler.java

public class CustomMethodSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler {
    private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();

    @Override
    protected MethodSecurityExpressionOperations createSecurityExpressionRoot(
            Authentication authentication, MethodInvocation invocation) {
        val root = new CustomMethodSecurityExpressionRoot(authentication);
        root.setPermissionEvaluator(getPermissionEvaluator());
        root.setTrustResolver(trustResolver);
        root.setRoleHierarchy(getRoleHierarchy());
        return root;
    }
}

CustomMethodSecurityExpressionRoot.java

public class CustomMethodSecurityExpressionRoot extends SecurityExpressionRoot implements MethodSecurityExpressionOperations {

    private Object filterObject;
    private Object returnObject;

    public CustomMethodSecurityExpressionRoot(Authentication authentication) {
        super(authentication);
    }

    /**
     * @param code code de la fonctionnalité
     * @return L'utilisateur a accès à la fonctionnalité <i>code</i>, quelque-soit le type de droit (READ ou WRITE) ?
     */
    public boolean hasFunctionality(String code) {
        if (StringUtils.isBlank(code)) {
            return false;
        }
        val authorityPrefix = code + ";";
        return getAuthentication().getAuthorities().stream().anyMatch(authority -> authority.getAuthority().startsWith(authorityPrefix));
    }

    @Override
    public void setFilterObject(Object filterObject) {
        this.filterObject = filterObject;
    }

    @Override
    public Object getFilterObject() {
        return filterObject;
    }

    @Override
    public void setReturnObject(Object returnObject) {
        this.returnObject = returnObject;
    }

    @Override
    public Object getReturnObject() {
        return returnObject;
    }

    @Override
    public Object getThis() {
        return this;
    }
}

WebSecurityConfig.java

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig {
    // static : https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html#customizing-expression-handling
    @Bean
    static CustomMethodSecurityExpressionHandler customMethodSecurityExpressionHandler() {
        return new CustomMethodSecurityExpressionHandler();
    }
}

Sources :

• https://www.baeldung.com/spring-security-create-new-custom-security-expression
• https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html#customizing-expression-handling