@PreAuthorize, @RolesAllowed, and @Secured are all annotations that allow configuring method security. They can be applied to both individual methods and at the class level. Method-level security is achieved using Spring AOP proxies.

@PreAuthorize

Spring Security 3 introduced support for @PreAuthorize and @PostAuthorize.

It allows defining access restrictions on a method using Spring Expression Language (SpEL). These restrictions are evaluated before the method is executed, and if the restrictions are not met, it can lead to the denial of the method execution.

It is part of the Spring Security framework. To be able to use it, the prePostEnabled attribute in the @EnableGlobalMethodSecurity annotation must be set to true:

@EnableGlobalMethodSecurity(prePostEnabled=true)

@PreAuthorize("hasRole('ROLE_VIEWER') or hasRole('ROLE_EDITOR')") // can be OR, AND
public boolean isValidUsername(String username) {}

@RolesAllowed

Its origin is in the JSR-250 Java security standard. This annotation is more limited than the @PreAuthorize annotation because it only supports role-based security. To use it, the library containing this annotation must be on the classpath, as it is not part of Spring Security. In addition, the jsr250Enabled attribute of the @EnableGlobalMethodSecurity annotation must be set to true:

@EnableGlobalMethodSecurity(jsr250Enabled=true)

@RolesAllowed({ "ROLE_VIEWER", "ROLE_EDITOR" }) // selected with OR
public boolean isValidUsername(String username) {
    //...
}

@Secured

It is an older Spring Security 2 annotation that can be used to configure method security. It supports more than just role-based security, but it does not support using Spring Expression Language (SpEL) to specify security constraints. In new applications, it is recommended to use the @PreAuthorize annotation over this annotation. To use it, the securedEnabled attribute must be enabled in the @EnableGlobalMethodSecurity annotation:

@EnableGlobalMethodSecurity(securedEnabled=true)

@Secured("ROLE_ADMIN") is the same as the @PreAuthorize("hasRole('ROLE_ADMIN')") annotation, but @Secured({"ROLE_USER","ROLE_ADMIN"}) is processed as ROLE_USER OR ROLE_ADMIN. It does not support the AND operator.

@Secured and @RolesAllowed express the same thing, and the difference is that @Secured is a Spring-specific annotation, whereas @RolesAllowed is a standard Java annotation (JSR250).

@Secured({ "ROLE_VIEWER", "ROLE_EDITOR" }) // selected with OR
public boolean isValidUsername(String username) {
    return userRoleRepository.isValidUsername(username);
}

@PreFilter

The @PreFilter annotation is used to filter a collection argument before executing the method:

@PreFilter("filterObject != authentication.principal.username")
public String joinUsernames(List<String> usernames) {
    return usernames.stream().collect(Collectors.joining(";"));
}

In this example, we are joining all usernames except for the authenticated user. Here, in our expression, we use the name filterObject to represent the current object in the collection. However, if the method has multiple arguments of a collection type, we must use the filterTarget property to specify which argument we want to filter:

@PreFilter(value = "filterObject != authentication.principal.username", filterTarget = "usernames")
public String joinUsernamesAndRoles(List<String> usernames, List<String> roles) {
    return usernames.stream().collect(Collectors.joining(";")) + ":" + roles.stream().collect(Collectors.joining(";"));
}

The following table shows the Spring Expression Language support of security annotations that can be used with Spring Security 5: