When do we use denyAll in spring security

Question

I am a bit confused as to why someone would use @PreAuthorize("denyAll") for a method. As per the spring security documentation, it always evaluates to false.

If we are not going to allow access to a particular method, what is the point of keeping such a method. Why not comment it out? Or is it that it can still be accessed from within the same class?

I am trying to understand under what scenario such a requirement would arise.

Answer 1

One small clarification that I found in general for deny all was

@DenyAll annotation can be used to restrict business interface access from anyone, logged in or not. The method is still invokable from within the bean class itself.

So the jist is it can be used for a method which is public for some reason or have been exposed (perhaps it implements an interface) but should never be called directly from outside. However they can be called from inside(within the class).

here is the link

One real example that I can give you is (which is quite related with my work). We have 2 business unit with same code base. Now in one unit there is a feature where some mobile reseller can directly call a service which cancels the voucher directly to the operator end but in the other unit we needed to block this due to some business rule. Since we use the same interface in both system so in one system we blocked its usage using denyall

Hope this gives you a clear idea.

Answer 2

I decorate my service classes in this way which requires the individual inner service methods to override the denying class level PreAuth annotation. This ensures that each method in the class will be appropriately secured w/a fallback to denyAll.

I know this is old but I stumbled on it looking for the syntax for @PreAuthorize('denyAll') and thought I'd throw my 2cents in.