java - Spring MVC controller inheritance with spring security -

i'm trying create generic controller using spring mvc 3.2.3 , spring security 3.1.3. i'm trying achieve this:

public abstract class datacontroller<e extends persistententity> { protected abstract e getentity(string id);  @requestmapping(value="/view/{id}", method=requestmethod.get) public string view(@pathvariable("id") string id, modelmap map) {       e ent = getentity(id);       map.put("entity", entity);       return "showentity";     } } 

my extended class have specific controller mapping in class name can access url using controller name:

@controller @requestmapping("/company**") @secured("role_admin") public class companiescontroller extends datacontroller<company> {     @autowired     private appservice appservice;      @override     protected company getentity(string id) {         return appservice.getcompany(id);     } } 

my problem url /company/view not secured role_admin , can accessed anyone, (i think) because /view not defined in controller @secured being used.

this can fixed overriding view method , define mapping in company class:

    . . .      @override     @requestmapping(value = "/view/{id}", method = requestmethod.get)     public string view(string id, modelmap map) {         return super.view(id, map);     }      . . . 

in case security works correctly, want know if there method. since have lot of methods in abstract class, create problem , mess override methods call super.

is there way fix issue?

thanks :)

i know it's year later, had same problem , figured out possible solution this. not 100% annotation based, works , elegant

the abstract superclass:

@preauthorize("hasanyrole(this.roles)") public abstract class datacontroller<e extends persistententity>  {     protected abstract e getentity(string id);      protected abstract string[] getroles();      @requestmapping(value="/view/{id}", method=requestmethod.get)     public string view(@pathvariable("id") string id, modelmap map) {        e ent = getentity(id);        map.put("entity", entity);        return "showentity";     }  } 

on subclass implement getroles() return array of roles required access class.

@preauthorize way check authentication, allows use spel expression. this.roles refers getroles() property on annotated object.