In this video, let's try to understand how to achieve level security by using the approach invocation
of tradition, so an invocation of tradition, we can configure alteration rules which will decide a
method can be invoked or not.
And this authorization check can happen in two ways.
One is before the matter is invoked using preauthorization annotation, and the other one is once the
method is executed by leveraging post authorization annotation.
Think of a scenario where inside your application you have a method at the service layer which called
lawn service and there is a method called Gatland details.
So this method will return all the loans of a specific user.
So for such methods, if you have a requirement where you want to configure authorization rules like
only an admin has to invoke this method are only the person who logged in can get his one loan details,
but not other details.
In such scenarios, we can use preauthorization annotation on top of the matter, as you can see.
So these are all the ways of how we can leverage Beatriz's annotation.
The very first annotation line will check whether the user logged in, has a rule of admin using has
authority.
But if you are using rules, we can also use Hasdrubal and you have multiple rules.
And a person who has any role, like admin or user, then you can leverage has any role method.
And at the same time we can also write spring expression, language, expressions inside preordering
sanitation.
So this is the reason why prioritize and post audra's are more powerful compared to other annotations
spelled like Aderet secured and a direct rule of law.
And at the same time we can also use has permission.
Matarasso, which is provided by spring security framework to decide whether a person are logged in
user or the invocation party is authorized to invoke that method or not.
So this is how we configure preauthorization rules in the invocation tradition approach.
Similarly, you may have a requirement once a method has been executed.
I don't want to stop the execution, but once the method has been executed after my business logic did
some database interactions and it is trying to load certain data from the database inside that method.
So in such scenarios, if I have a requirement where only certain users with certain authorities and
rules only should be able to receive that return values, then I'll go with the post address.
But please remember, if you use post authorized and the user is not authorized to invoke that method,
for starters, will still execute the business logic present inside that method, like it will commit
the transactions to database.
But while retaining the values to the user, if the alteration rules are not satisfying, then it will
troll for 083 error, which is an exception.
But please don't expect your database transactions to be rolled back, because even if you keep adding
transaction annotation on top of a method, the committee transactions to the database will not be rolled
back.
That's right.
Please be careful and you can expect the most common scenario that we can use is Beatriz's, but not
the post Autrey's.
But spring security provides to both features so that you can use based upon your requirement.
So just like how will we how has authority, has any authority, has rule and has any rule.
If we have a complex permissions like that, you want to apply complex alteration rules that you want
to apply based upon the data that it comes from the matter and based upon certain business requirements
that you have, which you can't put inside this annotation brackets.
In such scenarios, you can write your own permission evaluator class by extending this permission evaluator
interface and reading the matter has permission.
So in such scenarios, whenever you use has permission, the logic that you have written inside your
permission evaluator implementation class will be executed to decide whether the given person are given
client is authorized to invoke that method or is authorized to get the results from the method.
Whenever you use preauthorization post annotations, I hope it is making sense.
Let's try to go and do some handson in the next room.
Thank you.
On by.