title: Spring Security @PreAuthorize for validation of controller
body: <p>I have the following method in my Controller. </p>
  
  <pre><code>    @GetMapping("/update/{idpost}")
      public String showUpdateForm(
              @PathVariable int idpost, 
              @ModelAttribute("post") Post post,
              @ModelAttribute("user") User user,
              Model model) {
  
          post = postService.findById(idpost);
          model.addAttribute("post", post);
          return "_updateForm";
      }
  </code></pre>
  
  <p>It's showing form for updating exist post. </p>
  
  <p>I want to <strong>limit access to the user who made this post only</strong>. so that random user won't be able to access.</p>
  
  <p>so I tried this.. aiming to correspond, current user's email(authentication.name) with post's owner's email. but no luck.</p>
  
  <pre><code>    @PreAuthorize("#post.user.email == authentication.name")
      @GetMapping("/update/{idpost}")
      public String showUpdateForm(
              @PathVariable int idpost, 
              @ModelAttribute("post") Post post,
              @ModelAttribute("user") User user,
              Model model) {
  
          post = postService.findById(idpost);
          model.addAttribute("post", post);
          return "_updateForm";
      }
  </code></pre>
  
  <p>It turned out that, <strong>post</strong> argument has a null value. which is obvious as it is defined <strong><em>in</em></strong> the method. (or way I used it completely wrong.)</p>
  
  <p>Would you get what I am doing? How can I use @PreAuthorize for this purpose?</p>