title: spring security, method secure and url secure
body: <p>I'm learning spring security, but I get confused with it's flexibility..</p>
  
  <p>I know I can secure the urls by defining rules in  tag
  then I saw there is a @secure annotation which can secure methods.
  and then there are other annotations to secure Read/update by domains (or POJOs)</p>
  
  <p>so when I want to develop a typical permission/role/users web application, beside creating rules to secure urls, do I also have to use @secure annotation to secure methods?</p>
  
  <p>ej. </p>
  
  <ol>
  <li>user enter the restricted url</li>
  <li>application ask to login</li>
  <li>application check if the role can access the url</li>
  <li>user select "add new" option</li>
  <li>check again if that user has permission to call the method "addNew()"?? </li>
  </ol>
  
  <p>or one of step 4 or 5 is redundant.</p>
  
  <p>sorry about my English</p>