How to deal with defaultRolePrefix="ROLE_" in Spring Security update from 3.2.7 to 4.0.2.RELEASE

Question

My Spring Boot application works on Spring Security 3.2.7.RELEASE. Now, I'd like to update it to 4.0.2.RELEASE.

After hours of debug I have found that Spring Security 4.0.2.RELEASE uses defaultRolePrefix="ROLE_"

in

org.springframework.security.access.expression.SecurityExpressionRoot.hasAnyAuthorityName(String prefix, String... roles) method

In my application I use roles without this prefix and accordingly I get AccessDeniedException.

How to configure Spring Boot in order to use SecurityExpressionRoot.defaultRolePrefix="" ?

Answer 1

I found the solution how to fix it. I need to change hasRole to hasAuthority, for example:

@PreAuthorize("hasAuthority('PERMISSION_CREATE_NODE')")