title: Spring security - why does RoleVoter supports all classes and WebExpressionVoter only supports subclasses of FilterInvocation?
body: <p>In the <code>supports(Class clazz)</code> method of <code>RoleVoter</code>, it always returns true saying that </p>
  
  <blockquote>
    <p>This implementation supports any type of class, because it does not
    query the presented secure object.</p>
  </blockquote>
  
  <p>What is this "<strong>presented secure object</strong>". On the other hand, the <code>supports(Class clazz)</code> method of <code>WebExpressionVoter</code> returns true only if <code>clazz</code> is a subtype of <code>FilterInvocation</code>. Is <code>FilterInvocation</code> the "presented secure object" here and why does the voter has to support it ?</p>
  
  <p>If I use <code>@Secured</code> annotations over my methods and configure an access decision manager for global method security  that has <code>WebExpressionVoter</code> as one of the voters, it presents an error </p>
  
  <blockquote>
    <p>AccessDecisionManager does not support secure object class: interface
    org.aopalliance.intercept.MethodInvocation</p>
  </blockquote>
  
  <p>This is because all voters of an access decision manager (when configured for method security) must support the above class, and while <code>RoleVoter</code> and others do, <code>WebExpressionVoter</code> needs a subtype of <code>FilterInvocation</code>.</p>
  
  <p><code>SPEL</code> expressions in <code>@PreAuthorize</code> tag would also need <code>WebExpressionVoter</code>, and again it would be required to support <code>MethodInvocation</code> class, which it doesn't. But it does work. So what am I getting wrong here ?</p>