Interface-based proxies

In the given example from the previous section, Spring Security used an interface-based proxy to secure our getEvents method. Let's take a look at the simplified pseudocode of what happened to understand how this works:

    DefaultCalendarService originalService = context.getBean
    (CalendarService.class)
    CalendarService secureService = new CalendarService() {
     … other methods just delegate to originalService ...
      public List<Event> getEvents() {
        if(!permitted(originalService.getEvents)) {
           throw AccessDeniedException()
          }

       return originalCalendarService.getEvents()
      }
   };

You can see that Spring creates the original CalendarService just as it normally does. However, it instructs our code to use another implementation of CalendarService that performs a security check before returning the result of the original method. The secure implementation can be created with no prior knowledge of our interface because...