In this section, we will discuss a lot about method level security, which is an extra feature provided
by the spring security framework.
So as of now, we have applied authorization rules on top of our airports, like slashed lawns account.
So we apply like who and what authorities they should be able to access those parts.
It might be NVC parts are WIPA parts, but there might be a requirement in your application that you
want to bring this Australian rules to different layers of your application.
Like I want to put certain authorization rules, like who can execute the method in my service layer
or repository layer or any layer that your application has.
And at the same time, there is no guarantee that all the time the applications that you are going to
be will be Web applications.
There might be a scenario where you have non Web applications where you will not have any iPads are
emissive parts to configure attribution rules for altered scenarios.
Metal level security is the answer from spring security.
So this feature will help us in implementing authorization rules on top of methods inside our application.
The very first step that we have to take it in order to enable the metal level security is to use the
annotation update, enable global security on any of the configuration class, which has an annotation
under IT configuration.
So metal level security provides to a protest in order to apply any alteration rules on top of your
methods.
One is invocation authorization like based upon the rules that you configure, the spring security framework
will decide whether this method has to be invoked or not.
If there are any issues based upon the configurations like a certain user are, certain condition is
not satisfying, then the matter and location will be stopped and the forbidden error will be sent back
to the user.
And at the same time, we also have another approach which is filtering authorization.
Like I don't want to stop invocation of my method execution, but I want to control my business logic
based upon the parameters that my maternal issue and the parameters that it sends back to the invocation
method are AIPA are claimed.
So in such scenarios, if I want to apply some filtering conditions like for certain parameters, my
method execution should not happen or method business logic should not return.
Any values that the user is expecting for all such scenarios will go for the filtering alteration.
So to add to all this metal level security, spring security uses AOP module that we have inside the
spring framework.
So AOB module is something which it will provide some crosscourt or aspects which will access as intercept
us whenever you define inside your application.
So whenever we configure Matalan security inside our method, so spring security framework will leverage
this AOB module and have interceptors to intercept our material location to decide whether the authorization
rules configure is satisfied or not.
And all this metal level configurations like operation rules can be configured by using the following
Trevis.
The most famous way is like by using the annotations address Beatriz's and post outrace.
And at the same time, we also have another annotations from Java frameworks like Aderet Secular and
Aderet rules alone.
But compared to preauthorization, both Strattera is I could under direct rule allured are less powerful
because they have certain limitations compared to pre address and post outrace.
Due to that reason, a lot of people and a lot of applications, they are using pre operation post inside
their code, but at the same time, we can't go ahead and use them directly inside our application,
these annotations.
So whenever you're using a global method, security annotation inside your configuration class, you
have to enable them by passing these three parameters like proposal.
And it is called true secular and it is equally true.
And there are 250.
Annable is equal to true if any of these three parameters is missing inside your enable global method
security by default, that annotation you cannot use and springs' security framework will throw at it.
So now we have a basic understanding on what this metal level security inside spring security framework.
Let's try to understand in detail about invocation operation.
Shall rules how we can apply our tradition rules during my vacation in the next world.
Thank you.
And by.