Spring Security add multiple meta annotation

Question

I created a Spring Boot 2.3 application. I securited my REST endpoint and my services.

I created some meta annotations because I have many role. For example:

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("hasAnyRole('ROLE_CUSTOMER')")
public @interface IsCustomerUser {
}

and

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("hasAnyRole('ROLE_API')")
public @interface IsApiUser {
}

I've several of this meta annotations with many other roles. I thought I could add multiple meta annotations on my endpoints like this:

@IsCustomerUser
@IsApiUser
@GetMapping(path = "/tenants/current/avatar/{version}")
public ResponseEntity getAvatar(@PathVariable("version") long version) {
    //TODO some stuff

}

but it seems only one annotation is evalued. I see there is a feature request here. I'd like to know if you have some workaround in order to add multiple meta annotations. It is very annoying be forced to create all permutations of my basic security annotation. In fact I should create something like @IsAdminOrCustomerOrApiOrManagerOr.... and it's not really convenient.

Spring Security add multiple meta annotation

0 Answers