Files

asmhatre 73ab67b171 Add the filter-chain module

Companion project for "The Spring Security Filter Chain Explained". A real
Spring Boot 4.1.1 servlet application whose scenarios are Spring profiles, plus
a diagnostic controller that prints the live FilterChainProxy, the reflected
FilterOrderRegistration table, and the servlet container's own registrations.

Twelve captured transcripts under docs/output/, nine cross-linked doc chapters,
21 assertions.

Also fixes a broken relative link in method-security/docs/01: the cross-module
reference to context-propagation/README.md needed two levels up, not one.

2026-08-26 02:21:47 +00:00

output

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

01-how-method-security-runs.md

Add the filter-chain module

2026-08-26 02:21:47 +00:00

02-spel-reference.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

03-self-invocation.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

04-non-proxyable-methods.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

05-filtering.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

06-denied-handling.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

07-ordering-and-transactions.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

08-meta-annotations.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

09-audit-checklist.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

README.md

Split into per-article modules and add the method-security module

2026-08-25 02:01:29 +00:00

README.md

Method security: the chapters

Companion notes for Method Security in Spring Security 7 on ankurm.com. Read in order, or jump to whichever failure you are currently staring at.

#	Chapter	Answers
01	How method security actually runs	What `@EnableMethodSecurity` registers, and what happens between the caller and the method body
02	The SpEL reference	Everything you can write inside the annotation, evaluated for real
03	Self-invocation	Silent failure #1, why it happens, and three fixes
04	Methods the proxy cannot advise	Silent failure #2: `final`, `static`, `private`, interfaces, final classes
05	Filtering and `filterObject`	Silent failure #3: `@PreFilter` on an immutable argument, and which container types work
06	Denial: what is thrown, and how to change it	`AuthorizationDeniedException`, `@HandleAuthorizationDenied`, `@AuthorizeReturnObject`
07	Ordering, and `@PostAuthorize` vs `@Transactional`	Why a denied `@PostAuthorize` does not roll anything back by default
08	Meta-annotations and templates	Custom annotations, `{value}` templates, class-level rules, ambiguity
09	The audit checklist	What to grep for in an existing codebase, plus the edge-case index

Every claim in these chapters has a file under output/ behind it, regenerated by scripts/run-all.sh.