(doc issue) permitAll/denyAll listed as "methods" in docs but are actually fields in SecurityExpressionRoot #19728

Activity

1. yousef-fadli

   added

   status: waiting-for-triageAn issue we've not yet triagedAn issue we've not yet triaged

   type: bugA general bugA general bug

   on Sep 15, 2026
2. Akhil-1527 commented on Sep 26, 2026

   

   Akhil-1527

   on Sep 26, 2026

   More actions

   I looked into this and I think both readings are partly right. SecurityExpressionRoot has the two fields, and it also has permitAll() and denyAll() methods from SecurityExpressionOperations:

   public final boolean permitAll = true;
   public final boolean denyAll = false;
   
   @Override
   public final boolean permitAll() {
       return isGranted(this.authorizationManagerFactory.permitAll());
   }
   
   @Override
   public final boolean denyAll() {
       return isGranted(this.authorizationManagerFactory.denyAll());
   }

   So @PreAuthorize("permitAll") reads the field and @PreAuthorize("permitAll()") calls the method. The field Javadoc says it's there to allow the bare "permitAll" expression, and the example a little further down the same page uses that form (@PreAuthorize("denyAll")).

   With the default AuthorizationManagerFactory both forms give the same answer. The one difference I found is that only the method form goes through the factory, so if someone sets a custom factory that overrides permitAll() or denyAll(), the bare form won't pick that up.

   For the docs, a short note under the list saying permitAll and denyAll work both with and without parentheses might clear this up. I'm happy to open a PR for that if the team thinks it's worth it.
3. ZaMan0806 commented on Sep 28, 2026

   

   ZaMan0806

   on Sep 28, 2026

   More actions

   Thanks for looking into this, @Akhil-1527. Your explanation helped me understand the difference between the permitAll/denyAll fields and the permitAll()/denyAll() methods.

   While reading around, I noticed the same list also appears in the HTTP SpEL section of the reference docs, in case it's useful to cover both places:

   spring-security/docs/modules/ROOT/pages/servlet/authorization/authorize-http-requests.adoc

   Lines 807 to 809 in c2270bb

   	What follows is a quick overview of the most common methods:
   	* `permitAll` - The request requires no authorization to be invoked; note that in this case, xref:servlet/authentication/architecture.adoc#servlet-authentication-authentication[the `Authentication`] is never retrieved from the session

   Also, in that section the authentication and principal descriptions say "associated with this method invocation". Since that page is about HTTP requests, I wonder if it was meant to say "this request" instead:

   spring-security/docs/modules/ROOT/pages/servlet/authorization/authorize-http-requests.adoc

   Lines 819 to 820 in c2270bb

   	* `authentication` - The `Authentication` instance associated with this method invocation
   	* `principal` - The `Authentication#getPrincipal` associated with this method invocation