As in the authentication process, Spring Security provides an o.s.s.web.access.intercept.FilterSecurityInterceptor servlet filter, which is responsible for coming up with a decision as to whether a particular request will be accepted or denied. At the point the filter is invoked, the principal has already been authenticated, so the system knows that a valid user has logged in; remember that we implemented the List<GrantedAuthority> getAuthorities() method, which returns a list of authorities for the principal, in Chapter 3, Custom Authentication. In general, the authorization process will use the information from this method (defined by the Authentication interface) to determine, for a particular request, whether or not the request should be allowed.
Remember that authorization is a binary decision—a user either has access to a secured resource...