title: Spring Security + MVC : same @RequestMapping, different @Secured
body: <p>Let say we have an API endpoint configured using Spring MVC and Spring Security. We would like to be able to handle pairs of @RequestMapping and @Secured annotations where the only @Secured annotation values differ from pair to pair. This way, we would be able to return a different response body depending on security rules for the same request.</p>
  
  <p>This may allow our code to be more maintainable by avoiding to check for security rules directly into the method body.</p>
  
  <p>With a not working example, here is what we would like to do :</p>
  
  <pre><code>@Controller
  @RequestMapping("/api")
  public class Controller {
  
      @Secured ({"ROLE_A"})
      @RequestMapping(value="{uid}", method=RequestMethod.GET)
      @ResponseBody
      public Response getSomething(@PathVariable("uid") String uid) {
          // Returns something for users having ROLE_A
      }
  
      @Secured ({"ROLE_B"})
      @RequestMapping(value="{uid}", method=RequestMethod.GET)
      @ResponseBody
      public Response getSomethingDifferent(@PathVariable("uid") String uid) {
          // Returns something different for users having ROLE_B
      }
  }
  </code></pre>
  
  <p>How can we achieve this ?
  And if this can be done: How the priority should be managed for a user who has both ROLE_A and ROLE_B ?</p>