I have been trying to figure out an ACL solution for my application which should manage API endpoint's access rights dynamically. Some said that I have an option of Spring Security ACL. I checked it but lack of documentation frightened me a bit. So that I started to design my own ACL implementation; since I did not start implementation can not provide code example but at least I can provide the flow and components planned to be used.

  1. A security configuration service. Which will interact with required services to provide dao services between application and database (ofc this will have ref to DAO class as well)
  2. A new annotation to be used with aspect to tag/label all endpoints and to catch through aspect.
  3. An aspect service to intercept requests and check authorization.

So this a highly overall idea above definitions with their required helpers.

I will trigger aspect per end point access request. Since I know the label for the endpoint (written in the annotation) I can simply cross-check the access rule and user's roles ( I will access it through the Authentication object of Spring).

Any suggestion or a flaw I am missing here ?

  • 1
    Most security and access control frameworks provide the basics, and then let you define how you want to use them. Can you explain why re-inventing the services provided by, for instance, Spring Security ACL, gains you anything? – BobDalgleish Jan 9 at 17:24
  • Well tbh, I read a bit and found too much to go with than my requirements. And ofc the lack of documentation and resources lead me to there. – Olgun Kaya Jan 9 at 18:39

Following the searches, I have convinced to use the way of SpEL with @Preauthorize. Let me show it with an example (this is something looks like stackoverflow but for those who somehow hit to this page)

the page I used is github issues page's comments

for authorization component;

public class Authz {
public boolean hasReadAccess(MyUser myUser, Object object) {
    // ...
   return result;
  public boolean hasWriteAccess(MyUser myUser, Object object) {
    // ...
   return result;

And then use it for your methods like;

@PreAuthorize("@authz.hasReadAccess(principal, <method_name>)")

here the principal parameter filled by spring security itself

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.