Secure with @PreAuthorize

[adriendengreville]

I wanted to secure my endpoints using @PreAuthorize("hasAuthority('...')") because it seems that @Secured only handles roles, but it's not picked up.

Any idea on where to look in the codebase to secure the app using the @PreAuthorize annotation ?

[maxixcom]

Yes @Secure use only ROLE_ authorities as it is mentioned in annotation comments.

But I found that the annotation @PreAuthorize works fine. I use it like

    @DgsData(parentType = "Mutation", field = "updateCategory")
    @PreAuthorize("hasAuthority('admin:write')")
    fun updateCategory(input: CategoryUpdateInput): CategoryType? {
        return categoryService.update(input)
    }

Check if you have @EnableGlobalMethodSecurity(prePostEnabled = true) in your configuration.
I have it as follows:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
class SecurityConfig(
    private val jwtConfigProperties: JwtConfigProperties,
    private val userService: UserService
) : WebSecurityConfigurerAdapter() {

// ....

}

Hope it will help.

[adriendengreville]

It works like a charm like that, thanks !