title: How do hasRole() and hasPermission() web security expressions work?
body: <p>These are actually two questions, cause it isn't very well explained in the Spring Security reference. The first question is, when in my configuration I have a code like this:</p>
  
  <pre class="lang-java prettyprint-override"><code> @Override
  protected void configure(HttpSecurity http) throws Exception {
  
      http.authorizeRequests()
                  .antMatchers("/admin").hasRole("ADMIN")
                  .antMatchers("/admin").access("hasRole('ADMIN')");
  </code></pre>
  
  <p>then where is Spring looking for the current user's role in both cases? Is it perhaps calling loadUserByUsername() method on UserDetailsService and then getAuthorities() on acquired UserDetails?</p>
  
  <p>My second question is regarding the hasPermission() expression. Suppose I have a custom PermissionEvaluator, is there any way to make it working in the configuration class, e.g.:</p>
  
  <pre class="lang-java prettyprint-override"><code> @Override
  protected void configure(HttpSecurity http) throws Exception {
  
      http.authorizeRequests()
                  .antMatchers("/admin").access("hasPermission(...)")
  </code></pre>
  
  <p>Or is this an expression that works only on a method level?</p>