asmhatre
5e9e7f1b12
Moves the existing virtual-thread/context-propagation project into context-propagation/ and adds method-security/ for the Spring Security 7 method-security article: nine runnable demos, fourteen assertions, and every transcript the article quotes, regenerated by scripts/run-all.sh. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RSrsDSRKVsY588yFiMJMo9
1.7 KiB
1.7 KiB
Method security: the chapters
Companion notes for Method Security in Spring Security 7 on ankurm.com. Read in order, or jump to whichever failure you are currently staring at.
| # | Chapter | Answers |
|---|---|---|
| 01 | How method security actually runs | What @EnableMethodSecurity registers, and what happens between the caller and the method body |
| 02 | The SpEL reference | Everything you can write inside the annotation, evaluated for real |
| 03 | Self-invocation | Silent failure #1, why it happens, and three fixes |
| 04 | Methods the proxy cannot advise | Silent failure #2: final, static, private, interfaces, final classes |
| 05 | Filtering and filterObject |
Silent failure #3: @PreFilter on an immutable argument, and which container types work |
| 06 | Denial: what is thrown, and how to change it | AuthorizationDeniedException, @HandleAuthorizationDenied, @AuthorizeReturnObject |
| 07 | Ordering, and @PostAuthorize vs @Transactional |
Why a denied @PostAuthorize does not roll anything back by default |
| 08 | Meta-annotations and templates | Custom annotations, {value} templates, class-level rules, ambiguity |
| 09 | The audit checklist | What to grep for in an existing codebase, plus the edge-case index |
Every claim in these chapters has a file under output/ behind it, regenerated by
scripts/run-all.sh.