what is the difference between @PreAuthorize and @PostAuthorize in spring security

user_537647 0
Viewed 1111

What is the purpose of two different authorize method as conditions need to be evaluated before accessing any data?

spring-boot spring-security spring
1 Answers

@PreAuthorize:

The @PreAuthorize as name suggest can check for authorization before entering into method. The @PreAuthorize authorizes on the basis of role or the argument which is passed to the method.

  • Based on role or the argument which is passed to the method

@PostAuthorize:

The @PostAuthorize as name suggest checks for authorization after method execution. The @PostAuthorize authorizes on the basis of logged in roles, return object by method and passed argument to the method. For the returned object spring security provides built-in keyword i.e. returnObject.

  • Based in logged in roles, return object by method and passed argument to the method
user_5376470
Related