URL security and method security are two complementary layers in Spring Security: URL security gates access based on the request path, while method security gates access based on which specific method is being invoked, regardless of how the call arrived.
Key Points: • URL security is configured centrally in the SecurityFilterChain using requestMatchers() and role/authority checks. • Method security is applied per-method via annotations like @PreAuthorize, @PostAuthorize, or @Secured. • URL security only protects HTTP entry points; it can't stop an internal method call from another service class. • Method security can express richer, context-aware rules using SpEL, such as checking against method arguments or the returned object. • Using both together gives a coarse perimeter check at the URL level and precise enforcement at the business-logic level.
Example: A URL rule blocks non-admins from reaching /admin/**, but a @PreAuthorize on the deleteUser() service method also blocks the same operation if it's ever invoked from a different, unprotected controller or scheduled job.
Interview Tip: A concise interview answer is:
"URL security restricts access based on the request path, configured centrally in the filter chain, while method security uses annotations like @PreAuthorize directly on methods for finer, context-aware control that applies no matter how the method is invoked. In practice I use both—URL rules as a first gate, method rules for precise enforcement."