title: Controller (web request/antMatcher) security vs method(service) level security
body: <p>In Spring Security I see URL's secured with:</p>
  
  <pre class="lang-java prettyprint-override"><code>http
      .authorizeRequests()
          .antMatchers("/admin").hasRole("ADMIN");
  </code></pre>
  
  <p>I also see that there is method level security:</p>
  
  <pre class="lang-java prettyprint-override"><code>@PreAuthorize("hasRole('ADMIN')")
  </code></pre>
  
  <p>Are the <code>antMatchers</code> used to secure the URL while the <code>@PreAuthorize</code> used to secure interfaces?</p>
  
  <p>If the <code>antMatcher</code> secures the URL that calls the interface already, then why the need to separately secure the interface method?</p>
  
  <p>Could you use method level security on the controller like:</p>
  
  <pre class="lang-java prettyprint-override"><code>@PreAuthorize("hasRole('ADMIN')")
  @GetMapping("/dashboard/person")
  public String findEvent(Model model, HttpServletRequest request) {
  ....
  </code></pre>