advancedScenario Questions
Scenario 12: A @PreAuthorize check on a service method is being completely ignored when called from another method in the SAME class.
This is self-invocation: Spring's method security relies on an AOP proxy wrapping the bean, but a call from within the same class instance (this.method()) goes directly to the real object, bypassing the proxy entirely. Fix by moving the annotated method into a separate bean and calling it via injection, or by using AopContext.currentProxy() (requires exposeProxy=true) as a less clean alternative.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response