When do you use request authorization versus method security in Spring?

Uses HTTP rules for route-level policy and method security for reusable service operations without creating contradictory enforcement.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Request authorization is best for route-level rules such as public, authenticated, or admin-only endpoints. Method security, enabled explicitly, protects service operations with annotations such as @PreAuthorize and also applies when the operation is called from another adapter, not only HTTP. I use request rules as the coarse boundary and method security for reusable business capabilities or resource-sensitive checks.

Full answer below

Practice focus

authorizeHttpRequests, EnableMethodSecurity, pre/post authorization, non-HTTP entry points, ownership, and proxy boundaries.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
Web authorization protects an HTTP route; method security protects a Java operation wherever it is invoked through the secured proxy.
Request authorization is best for route-level rules such as public, authenticated, or admin-only endpoints. Method security, enabled explicitly, protects service operations with annotations such as @PreAuthorize and also applies when the operation is called from another adapter, not only HTTP. I use request rules as the coarse boundary and method security for reusable business capabilities or resource-sensitive checks.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
Method expressions can reference arguments and a dedicated authorization bean, which keeps complex policy out of annotation strings. Like other proxy advice, self-invocation can bypass a separately annotated inner method, so the protected operation needs a real proxy boundary. Post-authorization can reject a returned object, but the method has already run, making it dangerous for operations with side effects. Database queries must still scope data safely rather than loading forbidden graphs first.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Repeating different role rules in controllers and services.
Relying on a self-invoked secured helper.
Using post-authorization after irreversible side effects.

When do you use request authorization versus method security in Spring?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Next interviewer turn

Tech stacks

Skill areas

Suggest an improvement

Found this answer useful?