Authorizing the Requests

As in the authentication process, Spring Security provides an o.s.s.web.access.intercept.FilterSecurityInterceptor servlet filter, which is responsible for coming up with a decision as to whether a particular request will be accepted or denied. At the point the filter is invoked, the principal has already been authenticated, so the system knows that a valid user has logged in; remember that we implemented the List<GrantedAuthority> getAuthorities() method, which returns a list of authorities for the principal, in Chapter 3, Custom Authentication. In general, the authorization process will use the information from this method (defined by the Authentication interface) to determine, for a particular request, whether or not the request should be allowed.

This method serves as a means for an AuthorizationManager instance to acquire a precise String representation of the GrantedAuthority. By providing a representation as a String, most AuthorizationManager...