How to ensure #PreAuthorize has been defined? - spring-security

Question

We're using Spring Security #PreAuthorize annotation to check proper roles and permissions of Jersey-based REST APIs. What we're worried about is that we forget the annotation from some method, leaving it unsecured.
Is there a way to ensure that all APIs have the annotation, even if it is just #PreAuthorize("permitAll") (i.e. explicitly permitting everything)?
We're envisioning that if an API does not use the annotation, either the request is blocked (so that the API cannot be used) an error is logged (so that we notice the mistake quickly).
One way would be to make a custom expression that adds a request attribute marking the request as "secured". Then a web filter can check that the request attribute is in place and log an error if it is not.
Is there any cleaner way to do this? For example set "denyAll" as the default policy for un-annotated methods, and require overriding it as appropriate?

Answer 1

I finally resolved this by adding a Jersey ResourceFilterFactory which checks that each method or class has the annotation:
public class RestFilterFactory implements ResourceFilterFactory {
private static final Logger log = LoggerFactory.getLogger(RestFilterFactory.class);
#Override
public List<ResourceFilter> create(AbstractMethod method) {
ensurePreAuthorizedAnnotation(method);
return Arrays.emptyList();
}
private void ensurePreAuthorizedAnnotation(AbstractMethod method) {
boolean found = false;
if (hasPreAuthenticatedAnnotation(method)) {
found = true;
}
if (hasPreAuthenticatedAnnotation(method.getResource().getResourceClass())) {
found = true;
}
if (!found) {
log.error("Resource is not protected with #PreAuthorize annotation: " + method);
}
}
private boolean hasPreAuthenticatedAnnotation(AnnotatedElement element) {
Annotation a = element.getAnnotation(PreAuthorize.class);
return a != null;
}
}