advancedAuthorization: Roles, Authorities (RBAC) & Custom Filters
What's the actual difference between a Role and an Authority under the hood?
Both are ultimately represented as GrantedAuthority instances — there is no separate Java type for 'role' versus 'authority'. The only distinction is a naming CONVENTION: roles are, by convention, prefixed with ROLE_ and checked via hasRole()/hasAnyRole() (which automatically add/expect that prefix), while authorities have no fixed prefix and represent finer-grained permissions checked via hasAuthority()/hasAnyAuthority().
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response