title: spring-boot custom annotation for validating headers
body: <p>I am using spring-boot-1.5.10 and I am using spring-security in my application. I would like to create a custom annotation and which should using securityContext holder...Let me elaborate my question with sample code.</p>
  
  <blockquote>
    <p>curl -X GET -H "roles: READ" -H "Content-Type: application/json" -H
    "Accept: application/json" -H "app-name: sample" -H "app-id: sample"
    -H "customer-id: 123" -H "market: EN" -H "country-code: EN" -H "Accept-Language: application/json" -H "Cache-Control: no-cache"
    "<a href="http://localhost:9992/api/v1/apps" rel="nofollow noreferrer">http://localhost:9992/api/v1/apps</a>"</p>
  </blockquote>
  
  <p><strong>Controller</strong></p>
  
  <pre><code>@GetMapping("/apps")
  @PreAuthorize("hasAnyAuthority('ROLE_READ', 'ROLE_WRITE')")
  public ResponseEntity&lt;List&lt;Apps&gt;&gt; getApps(@AuthenticationPrincipal AppAuthentication appAuthentication) {
      if(appAuthentication.isGrantedAnyOf("ROLE_READ") &amp;&amp; isBlank(appAuthentication.getAppContext().customerId())) {
          throw new IllegalArgumentException("Missing header customerId");
      }
      if(appAuthentication.isGrantedAnyOf("ROLE_WRITE") &amp;&amp; isBlank(appAuthentication.getAppContext().customerId()) &amp;&amp; isBlank(appAuthentication.getAppContext().appId())) {
          throw new IllegalArgumentException("Missing header customerId &amp; AppId");
      }
      //write business logic here
  }
  </code></pre>
  
  <p>spring-security <strong>preAuthorize</strong> will only check if the roles are allowed.Also, I can enhance the preAuthorize annotation but it's common for many microservice and also i don't have permission to touch security realm. so, I would like to create a custom annotation. we should configure the roles &amp; headers to validate for the particular roles. Like below</p>
  
  <pre><code>@GetMapping("/apps")
  @PreAuthorize("hasAnyAuthority('ROLE_READ', 'ROLE_WRITE')")
  @ValidateHeaders("role=ROLE_READ",value={"customerId","app-id"})
  public ResponseEntity&lt;List&lt;Apps&gt;&gt; getApps(@AuthenticationPrincipal AppAuthentication appAuthentication) {
      //write business logic here
  }
  </code></pre>
  
  <p>Any hint would be really appreciable.</p>