(doc issue) permitAll/denyAll listed as "methods" in docs but are actually fields in SecurityExpressionRoot
Author: yousef-fadliCreated Sep 15, 2026Updated Sep 15, 2026
Labelsstatus: waiting-for-triagetype: bug
In the Method Security reference docs, under "Using Authorization Expression Fields and Methods,"
What follows is a quick overview of the most common methods:
and permitAll and denyAll are listed under the quick "overview of the most common methods".
However, in SecurityExpressionRoot , these are declared as fields, not methods:
public final boolean permitAll = true;
public final boolean denyAll = false;Source: spring-projects/spring-security