@PreAuthorize vs @Secured in Spring Security | What’s the Difference?

Spring Security provides multiple ways to secure methods. Two of the most commonly used annotations are @Secured and @PreAuthorize.

Although both are used for method-level security, they are not equally powerful.

Let’s understand the difference.

---

What is @Secured?

@Secured is a simple annotation used to restrict access to a method based on roles.

Example:

@Service
public class UserService {

    @Secured("ROLE_ADMIN")
    public void deleteUser(Long id) {
        // Delete user
    }
}

Only users with the ADMIN role can invoke this method.

It also supports multiple roles.

@Secured({"ROLE_ADMIN", "ROLE_MANAGER"})
public void approveLeave() {

}

A user having either ROLE_ADMIN or ROLE_MANAGER can execute the method.

However, @Secured only works with roles. It cannot evaluate method parameters, perform database checks, or execute complex authorization logic.

---

What is @PreAuthorize?

@PreAuthorize is a much more powerful annotation.

It performs authorization before the method executes and supports Spring Expression Language (SpEL).

Example:

@PreAuthorize("hasRole('ADMIN')")
public void deleteUser(Long id) {

}

Like @Secured, it can check roles.

But it can also check authorities.

@PreAuthorize("hasAuthority('DELETE_USER')")
public void deleteUser(Long id) {

}

It supports multiple roles.

@PreAuthorize("hasAnyRole('ADMIN','MANAGER')")
public void approveLeave() {

}

It can even evaluate method parameters.

@PreAuthorize("#username == authentication.name")
public User getProfile(String username) {

}

This ensures that a user can access only their own profile.

---

Real-World Example

Consider an e-commerce application.

A customer wants to cancel an order.

The API is

DELETE /orders/{orderId}

Both ADMIN and CUSTOMER are allowed to access this endpoint.

However, a customer should be able to cancel only their own order.

This cannot be implemented using @Secured.

Using @PreAuthorize, we can write

@PreAuthorize(
    "hasRole('ADMIN') || @orderSecurity.isOwner(#orderId)"
)
public void cancelOrder(Long orderId) {

}

Here,

orderSecurity.isOwner() checks the database to verify that the logged-in customer actually owns the order.

This kind of business-level authorization is impossible with @Secured.

---

Key Differences

Feature	@Secured	@PreAuthorize
Role-based authorization	✅	✅
Authority-based authorization	❌	✅
Method parameter checks	❌	✅
Spring Expression Language (SpEL)	❌	✅
Database/business logic checks	❌	✅
Complex conditions (AND, OR)	❌	✅
Fine-grained authorization	❌	✅

---

Which One Should You Use?

Use @Secured when you only need simple role-based authorization.

Example:

@Secured("ROLE_ADMIN")

Use @PreAuthorize when authorization depends on business rules such as:

• Resource ownership
• User permissions
• Method parameters
• Database values
• Custom authorization logic

This is why most modern Spring Boot applications prefer @PreAuthorize.

---

Interview Question

Interviewer: What is the difference between @Secured and @PreAuthorize?

Answer:

“@Secured provides simple role-based method security, whereas @PreAuthorize offers fine-grained authorization using Spring Expression Language (SpEL). @PreAuthorize can evaluate roles, authorities, method parameters, authentication details, and even custom business logic. Because of its flexibility, it is the preferred choice in modern Spring Boot applications.”

---

Final Thoughts

Both annotations provide method-level security, but they serve different purposes.

• Use @Secured for simple role-based checks.
• Use @PreAuthorize when your authorization logic goes beyond roles and depends on real business rules.

In enterprise applications, @PreAuthorize is generally the recommended approach because it provides much greater flexibility and scalability.