6

I am a bit confused as to why someone would use @PreAuthorize("denyAll") for a method. As per the spring security documentation, it always evaluates to false.

If we are not going to allow access to a particular method, what is the point of keeping such a method. Why not comment it out? Or is it that it can still be accessed from within the same class?

I am trying to understand under what scenario such a requirement would arise.

Willi Mentzel
  • 27,862
  • 20
  • 113
  • 121
Zack
  • 2,078
  • 10
  • 33
  • 58
  • 1
    The result of applying this annotations are useful at the proxy level instance of the bean (when other beans call the bean with the annotated method), but you can still use the method internally on the same bean not by the proxy instance, maybe you can use that combination when you want use the method just internally. – dgofactory Jul 08 '15 at 16:47
  • 1
    is there any documentation where I can get more details? Could you give an example where someone would like to have such a security configuration – Zack Jul 08 '15 at 16:51

2 Answers2

2

One small clarification that I found in general for deny all was

@DenyAll annotation can be used to restrict business interface access from anyone, logged in or not. The method is still invokable from within the bean class itself.

So the jist is it can be used for a method which is public for some reason or have been exposed (perhaps it implements an interface) but should never be called directly from outside. However they can be called from inside(within the class).

here is the link

One real example that I can give you is (which is quite related with my work). We have 2 business unit with same code base. Now in one unit there is a feature where some mobile reseller can directly call a service which cancels the voucher directly to the operator end but in the other unit we needed to block this due to some business rule. Since we use the same interface in both system so in one system we blocked its usage using denyall

Hope this gives you a clear idea.

Sarfaraz Khan
  • 2,166
  • 2
  • 14
  • 29
1

I decorate my service classes in this way which requires the individual inner service methods to override the denying class level PreAuth annotation. This ensures that each method in the class will be appropriately secured w/a fallback to denyAll.

I know this is old but I stumbled on it looking for the syntax for @PreAuthorize('denyAll') and thought I'd throw my 2cents in.

bwags
  • 998
  • 9
  • 16