Files

asmhatre 5e9e7f1b12 Split into per-article modules and add the method-security module

Moves the existing virtual-thread/context-propagation project into
context-propagation/ and adds method-security/ for the Spring Security 7
method-security article: nine runnable demos, fourteen assertions, and every
transcript the article quotes, regenerated by scripts/run-all.sh.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSrsDSRKVsY588yFiMJMo9

2026-08-25 02:01:29 +00:00

output

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

01-how-method-security-runs.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

02-spel-reference.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

03-self-invocation.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

04-non-proxyable-methods.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

05-filtering.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

06-denied-handling.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

07-ordering-and-transactions.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

08-meta-annotations.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

09-audit-checklist.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

README.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

README.md

Method security: the chapters

Companion notes for Method Security in Spring Security 7 on ankurm.com. Read in order, or jump to whichever failure you are currently staring at.

#	Chapter	Answers
01	How method security actually runs	What `@EnableMethodSecurity` registers, and what happens between the caller and the method body
02	The SpEL reference	Everything you can write inside the annotation, evaluated for real
03	Self-invocation	Silent failure #1, why it happens, and three fixes
04	Methods the proxy cannot advise	Silent failure #2: `final`, `static`, `private`, interfaces, final classes
05	Filtering and `filterObject`	Silent failure #3: `@PreFilter` on an immutable argument, and which container types work
06	Denial: what is thrown, and how to change it	`AuthorizationDeniedException`, `@HandleAuthorizationDenied`, `@AuthorizeReturnObject`
07	Ordering, and `@PostAuthorize` vs `@Transactional`	Why a denied `@PostAuthorize` does not roll anything back by default
08	Meta-annotations and templates	Custom annotations, `{value}` templates, class-level rules, ambiguity
09	The audit checklist	What to grep for in an existing codebase, plus the edge-case index

Every claim in these chapters has a file under output/ behind it, regenerated by scripts/run-all.sh.