How does Spring Security control access rights to resources and data?

Spring Security controls access to resources and data through security rule configurations that define who can do what in the application. The main mechanisms:

• Authentication — verifying the user's identity.
• Authorization — checking the user's rights to access specific resources.

Access control is implemented via:

1. Annotations (@PreAuthorize, @Secured), which are placed above methods and check permissions before execution.
2. HTTP security configuration, where access rules to URLs are set (for example, who can access /admin/**).
3. AccessDecisionManager — makes the decision to allow or deny access based on roles and rights.

Example configuration:

http
  .authorizeRequests()
    .antMatchers("/admin/**").hasRole("ADMIN")
    .antMatchers("/user/**").hasAnyRole("USER", "ADMIN")
    .anyRequest().authenticated();

Thus, Spring Security checks user rights based on roles and rules, and allows or denies access to resources.