I'm working on Spring MVC project that uses @PreAuthorize to handle method security. One controller grants access to two different types of users. However, based on another argument the user can be considered unauthorised. For example
- If the api client passes usertypeA and businessType1 the controller not retu 403
- If the api client passes usertypeB and businessType1 the controller retu 403
Is there a way in spring to do this without mixing the scurity code and the business logic for this controller?