title: Can I use SpringEL's boolean or operator with Spring security's @Preauthorize?
body: <p>When I tried to use the "or" operator in my @Preauthorize annotation I get the following error.</p>
  
  <pre><code>java.lang.IllegalArgumentException: Failed to evaluate expression '#authenticatingUser.id == #id or hasRole('ROLE_ADMIN')'
  </code></pre>
  
  <p>I think my syntax is correct as shown by the "or" examples in the below docs.</p>
  
  <p><a href="http://docs.spring.io/spring/docs/4.0.x/spring-framework-reference/html/expressions.html" rel="nofollow">http://docs.spring.io/spring/docs/4.0.x/spring-framework-reference/html/expressions.html</a></p>
  
  <p>And Spring Security says explicitly that it uses "Spring EL expressions"</p>
  
  <p><a href="http://docs.spring.io/spring-security/site/docs/3.0.x/reference/el-access.html" rel="nofollow">http://docs.spring.io/spring-security/site/docs/3.0.x/reference/el-access.html</a></p>
  
  <p>But I haven't seen any examples online of people using the boolean "or" operator in an @Preauthorize annotation.</p>
  
  <p>Here's the controller code for completeness. Ostensibly I want a user to be able to change their own password, or an admin. I have successfully used both the the <code>#authenticatingUser.id == #id</code> and the <code>hasRole('ROLE_ADMIN')</code> on their own, but with the or I get an error.</p>
  
  <pre><code>@RequestMapping(value = "{id}", method = RequestMethod.PUT)
  @ResponseBody
  @PreAuthorize("#authenticatingUser.id == #id or hasRole('ROLE_ADMIN')")
  public User newPassword(@PathVariable int id, @RequestParam String newPassword, @ModelAttribute User authenticatingUser) {
      User user = userService.findById(id);
      user.setPassword(newPassword);
      return userService.save(user);
  }
  </code></pre>