title: Creating custom PostAuthorize method in Spring Security
body: <p>I am trying to create a a custom method for use in Pre/Post Authorize calls like this:</p>
  
  <pre><code>public class CustomLSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler{
  
      public CustomSecurityExpressionHandler(){
          super();
      }
  
      @Override
      protected MethodSecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication, MethodInvocation invocation){
          CustomSecurityExpressionRoot root = new CustomSecurityExpressionRoot(authentication);
          root.setThis(invocation.getThis());
          root.setPermissionEvaluator(getPermissionEvaluator());
          return root;
      }
  }
  </code></pre>
  
  <p>and</p>
  
  <pre><code>public class CustomSecurityExpressionRoot extends SecurityExpressionRoot implements MethodSecurityExpressionOperations {
  
      private Object filterObject;
      private Object returnObject;
      private Object target;
  
      public CustomSecurityExpressionRoot(Authentication a) {
          super(a);
      }
  
      public boolean testDecision(String test){
          System.out.println("Printing:"+test+"\n");
      return true;
      }
  
      public void setFilterObject(Object filterObject) {
          this.filterObject = filterObject;
      }
  
      public Object getFilterObject() {
          return filterObject;
      }
  
      public void setReturnObject(Object returnObject) {
          this.returnObject = returnObject;
      }
  
      public Object getReturnObject() {
          return returnObject;
      }
  
      void setThis(Object target) {
          this.target = target;
      }
  
      public Object getThis() {
          return target;
      }
      public boolean hasPermission(Object permission) {
          try {
                  return super.hasPermission(null, null, permission);
          } catch (AccessDeniedException e) {
                  return false;
          }
      }
  
      public boolean checkPermission(Object permission) {
          return super.hasPermission(null, null, permission);
      }
  
      @Override
      public boolean hasPermission(Object targetId, String targetType, Object permission) {
          try {
                  return super.hasPermission(targetId, targetType, permission);
          } catch (AccessDeniedException e) {
                  return false;
          }
      }
  
      public boolean checkPermission(Object targetId, String targetType, Object permission) {
          return super.hasPermission(targetId, targetType, permission);
      }
  
      @Override
      public boolean hasPermission(Object target, Object permission) {
         try {
                  return super.hasPermission(target, permission);
         } catch (AccessDeniedException e) {
              return false;
         }
      }
  
      public boolean checkPermission(Object target, Object permission) {
          return super.hasPermission(target, permission);
      }
  }
  </code></pre>
  
  <p>As seen above I have added the new method testDecision(String), which I can successfully use in my preAuthorize call as below:</p>
  
  <pre><code>@PreAuthorize("testDecision('TestString')")
  Event getEvent(int eventId);
  </code></pre>
  
  <p>But when I call it in the context of a PostAuthorize as:</p>
  
  <pre><code>@PostAuthorize("testDecision('TestString')")
  Event getEvent(int eventId);
  </code></pre>
  
  <p>I get a ClassCastException:</p>
  
  <pre><code>SEVERE: Servlet.service() for servlet [Spring MVC Dispatcher Servlet] in context with path [/myapp] threw exception [Request processing failed; nested exception is java.lang.ClassCastException: com.example.CustomSecurityExpressionRoot cannot be cast to org.springframework.security.access.expression.method.MethodSecurityExpressionRoot] with root cause
  java.lang.ClassCastException: com.example.CustomSecurityExpressionRoot cannot be cast to org.springframework.security.access.expression.method.MethodSecurityExpressionRoot
      at org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler.setReturnObject(DefaultMethodSecurityExpressionHandler.java:156)
      at org.springframework.security.access.expression.method.ExpressionBasedPostInvocationAdvice.after(ExpressionBasedPostInvocationAdvice.java:49)
      at org.springframework.security.access.prepost.PostInvocationAdviceProvider.decide(PostInvocationAdviceProvider.java:38)
      at org.springframework.security.access.intercept.AfterInvocationProviderManager.decide(AfterInvocationProviderManager.java:73)
      at org.springframework.security.access.intercept.AbstractSecurityInterceptor.afterInvocation(AbstractSecurityInterceptor.java:282)
      at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:68)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
      at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
      at com.sun.proxy.$Proxy15.getEvent(Unknown Source)
  (..truncated..)
  </code></pre>
  
  <p>Anyone can help me figure out what I am doing wrong?</p>