How to use custom expressions in Spring Security @PreAuthorize/@PostAuthorize annotations

Since @PreAuthorize evaluates SpEl-expressions, the easiest way is just to point to a bean:

    @PreAuthorize("@mySecurityService.someFunction()")

MySecurityService.someFunction should have return type boolean.

Spring-security will automatically provide a variable named authentication if you want to pass the Authentication-object. You can also use any valid SpEl-expressions to access any arguments passed to your secure method, evaluate regular expressions, call static methods, etc. E.g:

    @PreAuthorize("@mySecurityService.someFunction(authentication, #someParam)")