What is the difference between @Secured, @RolesAllowed, and @PreAuthorize?

Advanced Spring Security

@Secured (Spring's own, older annotation) supports only simple role-based checks with no expression language, e.g. `@Secured("ROLE_ADMIN")`. @RolesAllowed is the JSR-250 standard equivalent, similarly simple and role-based, but framework-neutral. @PreAuthorize is the most powerful, supporting full SpEL expressions that can reference method arguments, the current Authentication object, and combine multiple conditions with boolean logic — which is why it's the generally recommended default for anything beyond the most trivial role check.