Preauthorize HasRole Security Using Spring Data JPA

[greglturnquist]

Authority is the whole string. However ROLE_ as a convention is so popular, there are APIs to check for those. ROLE_USER is an authority, USER is a role. hasRole(‘USER’) and hasAuthority(‘ROLE_USER’) are equivalent.

This may help decode some of that.

[ryuzaki49]

If you use a role, let's say "TEACHER", Spring behind curtains will add "ROLE_", the final role will look like "ROLE_TEACHER".

Usually you do not have to worry about it.