title: Spring MVC, Method level security
body: <p>I am trying to restrict access to my controller, based on user role. Now i can do that using the security.xml file in a following way</p>
  
  <pre><code>&lt;http use-expressions="true"&gt;
       &lt;intercept-url pattern="/**" access="hasRole([ROLE_ADMIN,ROLE_USER])" /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>But I dont want to do it this way. Rather i will write</p>
  
  <pre><code>&lt;http use-expressions="true"&gt;
       &lt;intercept-url pattern="/**" access="isAuthenticated()"/&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>and in the controller</p>
  
  <pre><code>@RequestMapping("/test")
  @PreAuthorize("hasRole('ROLE_USER')")
  public String test() {
      return "test";
  }
  
  @RequestMapping("/testadmin")
  @PreAuthorize("hasRole('ROLE_ADMIN')")
  public String testAdminPage() {
      return "testadmin";
  }
  </code></pre>
  
  <p>now ROLE_USER can access both (ROLE_ADMIN &amp; ROLE_ USER) tagged controller. this is the problem. 
  and based on this <code>testadmin.jsp</code> can only be viewed by ROLE_ADMIN type user and <code>test.jsp</code> can only be viewed by "ROLE_USER" type user.</p>
  
  <p>To sum up rather than writing the access code in the xml file i want to control it from the controller.</p>
  
  <p>How do i do this??</p>