title: Custom Permission Evaluator Spring
body: <p>I want to create a custom Permission Evaluator in order to @PreAuthorize a REST Endpoint with a custom method.
  I use Spring Boot 1.5.3 with the web and security starter.</p>
  
  <p>My further use case would be to check, if the logged in user is authorized to view the specified id.</p>
  
  <p>Upon calling the REST endpoint I get the following error:</p>
  
  <pre><code>org.springframework.expression.spel.SpelEvaluationException: EL1004E: Method call: Method hasPermission(null) cannot be found on org.springframework.security.access.expression.method.MethodSecurityExpressionRoot type
  </code></pre>
  
  <p>My Custom Permission Evaluator:</p>
  
  <pre><code>@Component
  class CustomPermissionsEvaluator implements PermissionEvaluator {
  
      public boolean hasPermission(String id) {
          return id.equals("correct");
      }
  
      @Override
      public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
          return false;
      }
  
      @Override
      public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
          return false;
      }
  }
  </code></pre>
  
  <p>My Security Configuration:</p>
  
  <pre><code>@Configuration
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  class SecurityConfig extends GlobalMethodSecurityConfiguration {
  
      @Override
      public MethodSecurityExpressionHandler createExpressionHandler() {
          DefaultMethodSecurityExpressionHandler methodSecurityExpressionHandler = new DefaultMethodSecurityExpressionHandler();
          methodSecurityExpressionHandler.setPermissionEvaluator(new CompanyPermissionsEvaluator());
          return methodSecurityExpressionHandler;
      }
  }
  </code></pre>
  
  <p>My Rest Controller:</p>
  
  <pre><code>@RestController
  class RestControllerToProtect {
  
      @PreAuthorize("hasPermission(#id)")
      @GetMapping
      public String methodToProtect(String id) {
          return "Authenticated";
      }
  }
  </code></pre>
  
  <p>Stacktrace:</p>
  
  <pre><code>org.springframework.expression.spel.SpelEvaluationException: EL1004E:
  Method call: Method hasPermission(null) cannot be found on
  org.springframework.security.access.expression.method.MethodSecurityExpressionRoot type
  </code></pre>