Spring Method Security with protect-pointcut

In previous example of method level security, we added security using @PreAuthorize annotation. Annotations are good way and quick way too to add security on any method. But there is one problem, it tightly couple your application code to spring. It is not desirable, at least in theory and in terms of best practices. A recommended approach is to add all such security definitions to xml configuration file. This way you can always change the implementation without touching your source code.


In this example, I have using a typical employee management screen. There are two basic operations, ADD and DELETE.

  1. Add requires a authenticated user to have either "ROLE_USER" or "ROLE_ADMIN".
  2. Delete is more protected and requires admin access i.e. only ROLE_ADMIN are allowed to delete a user.

I have two users in application i.e. admin and lokesh. admin user has both roles “ROLE_USER” and “ROLE_ADMIN“, but another user lokesh has only “ROLE_USER” access.

	<user name="lokesh" password="password" authorities="ROLE_USER" />
	<user name="admin"  password="password" authorities="ROLE_USER,ROLE_ADMIN" />

Above security configuration will allow both users to add a user, but only admin should be able to delete a user.

Let’s look at major functional points in example application.

XML Based Spring Security using protect-pointcut

The complete XML configuration looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
		<protect-pointcut expression="execution(* com.howtodoinjava.service.*Impl.add*(..))" access="ROLE_USER"/>
		<protect-pointcut expression="execution(* com.howtodoinjava.service.*Impl.delete*(..))" access="ROLE_ADMIN"/>
	<http auto-config="false"  use-expressions="true">
		<intercept-url pattern="/login" access="permitAll" />
		<intercept-url pattern="/logout" access="permitAll" />
		<intercept-url pattern="/accessdenied" access="permitAll" />
		<intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
		<form-login login-page="/login" default-target-url="/list" authentication-failure-url="/accessdenied" />
		<logout logout-success-url="/logout" />

	<authentication-manager alias="authenticationManager">
                <user name="lokesh" password="password" authorities="ROLE_USER" />
                <user name="admin" password="password" authorities="ROLE_USER,ROLE_ADMIN" />
    <beans:bean id="employeeDAO" class="com.howtodoinjava.dao.EmployeeDaoImpl" />
    <beans:bean id="employeeManager" class="com.howtodoinjava.service.EmployeeManagerImpl" />

Manager class where security is applied

package com.howtodoinjava.service;

import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import com.howtodoinjava.dao.EmployeeDAO;
import com.howtodoinjava.entity.EmployeeEntity;

public class EmployeeManagerImpl implements EmployeeManager {
    private EmployeeDAO employeeDAO;

	public void addEmployee(EmployeeEntity employee) {

	public List<EmployeeEntity> getAllEmployees() {
		return employeeDAO.getAllEmployees();

	public void deleteEmployee(Integer employeeId) {

	public void setEmployeeDAO(EmployeeDAO employeeDAO) {
		this.employeeDAO = employeeDAO;

I am skipping rest of the code, because it is completely identical to previous security example using annotations. Also, you can download the sourcecode if any thing needs to be referred.

Test the application

1) Login with user “lokesh”


2) Add an employee into the list


3) User is added successfully


4) Try to delete employee. Access denied.


5) Login with admin user


6) Add an employee into the list


7) User is added successfully


8) Try to delete employee. Employee Deleted.


9) Try to delete another employee. Employee Deleted.


Sourcecode Download

Happy Learning !!

Oldest Most Voted
Inline Feedbacks
View all comments

Comments are closed for this article!

About Us

HowToDoInJava provides tutorials and how-to guides on Java and related technologies.

It also shares the best practices, algorithms & solutions and frequently asked interview questions.