title: Can I use the Spring Security @PreAuthorize to inspect the HTTP headers?
body: <p>I have a REST API written in Spring with Spring Security and Spring Boot with the Web Started pack. Few of my methods inspect a JWT token:</p>
  
  <pre><code>@RequestMapping(value = "/list",
          method = GET,
          produces = APPLICATION_JSON_VALUE)
  public HttpEntity&lt;List&lt;Item&gt;&gt; list(@RequestHeader(name = TOKEN_HEADER) String token) {
      // validate token
      // do something
  }
  </code></pre>
  
  <p>Is it possible to move the token inspection to a method that would be invoked through the <code>@PreAuthorize</code> annotation? Something like:</p>
  
  <pre><code>@RequestMapping(value = "/list",
          method = GET,
          produces = APPLICATION_JSON_VALUE)
  @PreAuthorize("myMethod(headers)")
  public HttpEntity&lt;List&lt;Item&gt;&gt; list(@RequestHeader(name = TOKEN_HEADER) String token) {
      // do something
  }
  
  void myMethod(HttpHeaders headers) {
      // validate token
  }
  </code></pre>
  
  <p>The token contains some information about the resources that can be accessed by specific users. If the token doesn't contain the resource that the user requests or the data in underlying data layer indicate the user doesn't have access to it, I am returning HTTP 403.</p>