Why are the annotations @PreAuthorize, @HasRole, etc. is it recommended to install in the service and not in the controller?

Question

Java

I met a recommendation that it is better to install security annotations on service methods, and not on the controller. On the one hand, this is logical (because the authorization logic is encapsulated in the service), but on the other hand, it is inconvenient - you have to go into the service in order to understand which role this or that controller method belongs to.

What is the reason why security annotations are recommended to be installed in the service?

Answer 1

Good afternoon.
Here is a pretty good answer to your question:
https://stackoverflow.com/questions/14626969/shoul...