Handling of Invocations

Spring Security offers interceptors that are responsible for governing access to secure objects, be it method invocations or web requests. AuthorizationManager instances play a crucial role in making pre-invocation decisions regarding whether the invocation is permitted to proceed. Additionally, these instances contribute to post-invocation decisions, determining whether a particular value may be returned.

The AuthorizationManager class

AuthorizationManager takes precedence over both AccessDecisionManager and AccessDecisionVoter. Applications that customize either an AccessDecisionManager or an AccessDecisionVoter are advised to transition using AuthorizationManager.

Spring Security’s request-based, method-based, and message-based authorization components invoke AuthorizationManager instances, assigning them the responsibility of making definitive access control decisions.

The check method of AuthorizationManager receives all the pertinent...