title: Custom method within spring @Preauthorize
body: <p>I am implementing an application which has some methods to which's access will be fully based on permissions. The permissions are implemented using Spring. The permissions are added using <strong>@PreAuthorize</strong> annotation on top of the methods. The problem is that I would like to have fully custom methods (EL) within the annotations. 
  So what I would like to achieve is for instance:</p>
  
  <pre><code>@PreAuthorize("customAllowThis()")
  public void foo() { }
  </code></pre>
  
  <p>I think there are two approaches:</p>
  
  <p>Approach 1:
  Try to override <strong>SecurityExpressionRoot</strong> and add my custom methods there. I will use multiple authorisation services on different methods, so putting all specific methods to SecurityExpressionRoot would be a big chaos.</p>
  
  <p>Approach 2:
  Create service and place the method there:</p>
  
  <pre><code>@Component
  public class AuthorisationService {
      public boolean allowThis() {
           return true;
      }
  }
  </code></pre>
  
  <p>and do something like:</p>
  
  <pre><code>@PreAuthorize("@authorisationService.customAllowThis()")
  public void foo() { }
  </code></pre>
  
  <p>I much more prefer Approach 2 although it looks for me like it would bypass the "natural order" of Spring. Are there any good/best practices in terms of how to handle such situation? The point is that I wouldn't like to stick all specific methods into one class but from the other hand I wouldn't like to do something "dirty".</p>