Unit Test Security Authorization

Testing Spring Security authorization often means spinning up full contexts or discovering your @PreAuthorize annotations aren't actually doing anything because you forgot @EnableMethodSecurity. This skill gives you the patterns to test role-based access control with @WithMockUser, verify both allow and deny cases, and catch the silent failure modes where security gets bypassed. It covers @PreAuthorize, @Secured, @RolesAllowed, custom permission evaluators, and expression-based rules. The included validation tips are solid, especially the reminder that method security works through proxies and that you need to test the access denied path just as much as the happy path.

skills.sh installs: 3.9K
GitHub stars: 369
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add giuseppe-trisciuoglio/developer-kit --skill unit-test-security-authorization --agent claude-code

Installs into .claude/skills of the current project.

Files

Unit Testing Security and Authorization

Overview

This skill provides patterns for unit testing Spring Security authorization logic using @PreAuthorize, @Secured, @RolesAllowed, and custom permission evaluators. It covers testing role-based access control (RBAC), expression-based authorization, custom permission evaluators, and verifying access denied scenarios without full Spring Security context.

When to Use

Use this skill when:

Testing @PreAuthorize and @Secured method-level security
Testing role-based access control (RBAC)
Testing custom permission evaluators
Verifying access denied scenarios
Testing authorization with authenticated principals
Want fast authorization tests without full Spring Security context

Instructions

Follow these steps to test Spring Security authorization:

1. Set Up Security Testing Dependencies

Add spring-security-test to your test dependencies:

<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-test</artifactId>
  <scope>test</scope>
</dependency>

SKILL.md on GitHub

Details

Repository: github.com/giuseppe-trisciuoglio/developer-kit
Categories: Testing & QA, Security, Java & JVM
First seen: May 16, 2026