intermediateAuthorization & Role-Based Access Control
What's the difference between a Spring Security 'role' and an 'authority'?
An authority is the raw granted permission string (e.g. `ROLE_ADMIN`, `SCOPE_read`), while a 'role' is really just a naming convention — Spring Security's role-based helpers (`hasRole("ADMIN")`) automatically prepend `ROLE_` when checking against authorities. Understanding this prevents a common bug: calling `hasRole("ROLE_ADMIN")` accidentally checks for `ROLE_ROLE_ADMIN` and always fails.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response