title: How do I check method level spring security
body: <p>I have implemented spring security in controller method.</p>
  
  <p>Below is my spring security.xml </p>
  
  <p>
      
   -->
      </p>
  
  <pre><code>&lt;!-- URL pattern based security --&gt;
  &lt;security:http auto-config="false" entry-point-ref="authenticationEntryPoint"
      use-expressions="true"&gt;
      &lt;custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER" /&gt;
      &lt;security:intercept-url access="hasAnyRole('ROLE_ADMIN','ROLE_USER')" pattern="/common/admin/**" /&gt;
      &lt;security:intercept-url pattern="/common/accounting/**" access="hasRole('ROLE_USER')" /&gt;
      &lt;security:logout logout-url="/j_spring_security_logout" invalidate-session="true" logout-success-url="/login"/&gt;
  
  &lt;/security:http&gt;
  </code></pre>
  
  <p>Below is my controller </p>
  
  <pre><code>@Secured({"ROLE_ADMIN"})
  @RequestMapping(value = "/common/admin/addAdmin", method = RequestMethod.GET)
  public String add(ModelMap map) {
      map.addAttribute(new Administrator());
      return "/common/admin/addAdmin";
  }
  
  @Secured({"ROLE_ADMIN"})
  @RequestMapping(value = "/common/admin/addAdmin", method = RequestMethod.POST)
  public String processadd(
          @ModelAttribute("administrator") Administrator administrator) {
      this.administratorManager.addAdmin(administrator);
      return "/common/admin/success";
  }
  </code></pre>
  
  <p>I allow the url /common/admin/** for both admin and user role. But i do some restriction in the admin controller. when user is go in to /common/admin/* as a user role, he can but he can also go in to method that is only for admin role only. </p>
  
  <p>How can I solve it?</p>
  
  <p>Thanks!</p>