Summary

After reading this chapter, you should have a firm understanding of how Spring Security authorization works for HTTP requests and methods. With this knowledge, and the provided concrete examples, you should also know how to extend authorization to meet your needs. Specifically, in this chapter, we covered the Spring Security authorization architecture for both HTTP requests and methods. We also demonstrated how to configure secured URLs from a database.

We also saw how to create a custom PermissionEvaluator object and custom Spring Security expression.

In the next chapter, we will explore how Spring Security performs session management. We will also gain an understanding of how it can be used to restrict access to our application.