In this video, let's try to lose some pants on on preauthorization and post authorization annotations
in order to achieve a level security.
So for the same first, I just wanted to tell you, we have my launch pad, which can be accessed by
a user who has a role route.
But in our application, we don't have any role with the name route.
We have only user and been.
So for that reason, this part is always not accessible for our login user.
So let's try to test that once I'm going to my UI application and third login credentials able to login.
Now I'm clicking loans and you can see I'm not getting any response.
The reason for Biran like four zero three ever know.
What I will do is I will make this launch pad to be accessible by any authenticated user by replacing
this hash and roll with authenticator.
So with this change, after I restarted my application, I should be able to access the loans page Azrael
let our application stack.
Once our application is started, we can go to our other login page and our credentials now inside our
application.
If you click on loans, you will get a response from the backend because I don't have a role route since
now I open this part, my loans to any authenticated user, I'm able to access it now.
So now for this long speech, let's try to put some meter level security by using preorders and post
authorization for that.
First, I have to go to my configuration class.
On top of this configuration class.
I have to keep an annotation enabled global matters.
Security by passing three parameters pre post enabled will help me to enable the annotations of creators
and post authorize securer enable is for Ateret secure and GSR 250 enabled is for a direct all alone,
but now will use only preadolescent post outraced because in the same manner we can also upload secured
under rules allowed by and rule allowed has limitations that they can't leverage.
Spring expression language just like preauthorization post.
So due to that reason I'm giving a demo using preadolescent post posteriors.
So now I have enabled the global method security by using this annotation.
And if you can observe, we have not made any changes inside our Bombed-out XML because this comes from
the spring security based package itself when you don't have to import any other dependencies.
Now, I'll go to the Materne loan repository again.
You can keep this metal level security on any layer like repository layer control and layer our service
layer.
So in this scenario, just keeping on my repository layer by using three annotation.
And here, since we have rules defined inside our application, but not the authorities I'm using has
a role.
And I will mention if someone has ruled role, then they should be able to invoke this method, otherwise
they should not be able to invoke it.
So we have made these changes.
Let's try to restart our application.
And Lockard from the UI, if I try to log in again previously, we are able to see the launch page because
there is no restrictions on the rules.
But now I have kept my third level security using proprietaries annotation, so I'm trying to login
and clicking one, two, three, four, five.
As a password.
I'm able to login into the application.
Now, if I click on loans tab, I will not get any response with the same error four zero three.
So as you can see now, we made our application to have method level security instead of pad level security,
especially for the loan speech.
So in this way we can apply some method level security using preauthorization.
Now let's try to do the same using post authorization annotation, whether I'll just replace the previous
post.
But instead of here, I will just keep it the controller layer so that you can understand in any layer
we can keep this algo to launch controller.
And I'm keeping on top of this matter.
If someone has rolled route, then only they can be able to get the results from this method.
Otherwise they will not get the results.
But still the method will be executed.
I can show you that by keeping a breakpoint now, I will restart my application and I'm entering my
credentials again.
I'm logged in.
I'm clicking on launch.
You can see a breakpoint has been stopped and there'll be a call will go to database and I'm able to
get the loans details from the data.
But the same details will not be passed to the UAE because the user does not have Ruparel.
As you can see, my mattress executer, the users did not receive the results because he's not authorized
to receive the results from the meter due to the alteration rules that we define using post Autrey's
annotation.
Due to that, he will get an error for zero three, which indicates forbidden.
So in this way, we can also apply post alteration rules.
But please do remember your logic defined inside the method will be executed and in the case of even
exception, is ruled by the security framework.
The database transactions will not be rolled back, which you have to always consider while using Pontchartrain's
annotation.
At the same time, you have a requirement similar to checking the authorities of the user.
Then you can always rely on his rule, has authority, has any authority.
But if you have a complex requirement where you want to validate based upon the data issued are based
upon the data that is being sent, the color in altered scenarios we can always use has permissions
inside your annotation, preauthorization and arrays.
And this has permission by default will use spring expression language.
And if we have some scenarios where even spring expression language, you are not able to achu and you
want to write your own custom code in such scenarios, you have to implement permission evaluator inside
your custom class that you are writing.
So once you implement this interface, there are two methods, has permission with the same name or
other methods which you can write and you can see here, these methods will get the authentication object
of the current user logged in.
And what is the return type object that your method is is returning along with the permission that you
want to apply.
So if we can write all your custom code inside this method, your spring framework will use this permission
evaluator to consider your custom requirements, which is a complex scenario.
But ideally, most of you authorities requirements, authorization requirements can be achieved using
preauthorization post.
I hope you understand what we have done in this lecture.
In the next video, let's try to understand how to apply alteration rules using filtering.
Thank you.
And see you in the next lecture by.