Difference between @RolesAllowed and @PreAuthorize("hasAuthority")?

[kkhanhluu]

I post this question to know the difference between these 2 annotations. When i submit a valid token with realm_access.roles = ['user'], only the @PreAuthorize annotation works and the @RolesAllowed always returns status 403. Can someone give me clarification?

[ch4mpy]

"Roles" in spring-security world are "authorities" with ROLE_ prefix.

Those 3 are the same:

• @PreAuthorize("hasAuthority('ROLE_user')")
• @PreAuthorize("hasRole('user')")
• @RolesAllowed("user")

If the roles are not prefixed with ROLE_ in access-token, either:

• use hasAuthority
• configure the authorities converter to add ROLE_ prefix (this can be done from properties or yaml file if you use my starters and kept default authorities mapper).

[kkhanhluu]

Thanks for your answer