(doc issue) permitAll/denyAll listed as "methods" in docs but are actually fields in SecurityExpressionRoot

Author: yousef-fadliCreated Sep 15, 2026Updated Sep 15, 2026
Labelsstatus: waiting-for-triagetype: bug

In the Method Security reference docs, under "Using Authorization Expression Fields and Methods,"

What follows is a quick overview of the most common methods:

and permitAll and denyAll are listed under the quick "overview of the most common methods".

However, in SecurityExpressionRoot , these are declared as fields, not methods:

public final boolean permitAll = true;
public final boolean denyAll = false;

Source: spring-projects/spring-security