Creating a custom expression

The o.s.s.access.expression.SecurityExpresssionHandler interface is how Spring Security abstracts how the Spring expressions are created and initialized. Just as with the SecurityMetadataSource interface, there is an implementation for creating expressions for web requests and creating expressions for securing methods. In this section, we will explore how we can easily add new expressions.

Configuring a custom SecurityExpressionRoot

Let’s assume that we want to support a custom Web Expression named isLocal that will return true if the host is localhost and false otherwise. This new method could be used to provide additional security for our SQL console by ensuring that it is only accessed from the same machine that the web application is deployed from.

This is an artificial example that does not add any security benefits since the host comes from the headers of the HTTP request. This means a malicious user could inject a header stating that...