AOP for managing transactions and security

"Why use AOP for transactions and security?" — good question!

Imagine that in every method you need to:

1. Check user permissions
2. Start a transaction
3. Execute business logic
4. Close the transaction
5. If something goes wrong — roll back the changes

And do that for every single method! That leads to a huge amount of duplicated code. AOP solves this by moving transactions and security into separate "layers" that run automatically.

Managing transactions with AOP

A Transaction is a sequence of actions executed as a single unit. If one of the actions in a transaction fails, all changes are rolled back. In the Spring world transactions feel almost like magic thanks to the @Transactional annotation. But spoiler: under the hood AOP is doing the work.

How does AOP help with transactions?

Spring uses AOP to intercept calls to methods annotated with @Transactional. It creates proxy objects for your components (usually services) and wraps the invoked method in a transactional context. That lets it automatically start a transaction before the method runs and either commit (or roll back) after it finishes.

Example: simple transaction management

Here's a sample service where transactional behavior is applied via @Transactional.

@Service
public class AccountService {

    @Autowired
    private AccountRepository accountRepository;

    @Transactional
    public void transferMoney(Long fromId, Long toId, Double amount) {
        // Withdraw money from one account
        Account fromAccount = accountRepository.findById(fromId)
                .orElseThrow(() -> new IllegalArgumentException("Account not found"));
        fromAccount.setBalance(fromAccount.getBalance() - amount);

        // Add money to the other account
        Account toAccount = accountRepository.findById(toId)
                .orElseThrow(() -> new IllegalArgumentException("Account not found"));
        toAccount.setBalance(toAccount.getBalance() + amount);

        // Save changes
        accountRepository.save(fromAccount);
        accountRepository.save(toAccount);
    }
}

In this example, if transferMoney throws an exception (for example, not enough funds), all changes will be rolled back automatically.

How does it work under the hood?

• Spring creates a proxy for AccountService.
• When a method annotated with @Transactional is called, the proxy opens a transaction.
• If the method finishes without errors, the transaction is committed. If an error occurs, the transaction is rolled back.

Security with AOP

Security is about protecting application data and resources from unauthorized access. In the Spring world Spring Security handles that, and AOP plays an important role here too.

There are two main cases where AOP helps with security:

1. Checking access rights (authorization).
2. Checking user authentication.

Spring Security uses AOP to intercept method calls or resource access and validate permissions (for example, user roles).

Example: method authorization

You can use the @Secured annotation to restrict access to a specific method:

@Service
public class AccountService {

    @Secured("ROLE_ADMIN")
    public void deleteAccount(Long accountId) {
        // Code to delete an account
        System.out.println("Account with ID " + accountId + " deleted.");
    }
}

Here the deleteAccount method can only be called by users with the ROLE_ADMIN role. Spring Security under the hood creates an AOP proxy to check security before the method call.

Practice: AOP for transactions and security

Step 1: Configure Spring Security

Let's add a basic security setup.

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            .and()
            .formLogin()
            .and()
            .httpBasic();
    }
}

This restricts access to URLs starting with /admin to users with the ADMIN role only.

Step 2: Add a transactional service

Let's create a service with a transaction to manage account balances.

@Service
public class MoneyTransferService {

    @Autowired
    private AccountRepository accountRepository;

    @Transactional
    public void transferMoney(Long fromAccountId, Long toAccountId, Double amount) {
        Account fromAccount = accountRepository.findById(fromAccountId)
                .orElseThrow(() -> new IllegalArgumentException("Account not found"));
        fromAccount.setBalance(fromAccount.getBalance() - amount);

        Account toAccount = accountRepository.findById(toAccountId)
                .orElseThrow(() -> new IllegalArgumentException("Account not found"));
        toAccount.setBalance(toAccount.getBalance() + amount);

        accountRepository.save(fromAccount);
        accountRepository.save(toAccount);
    }
}

Step 3: Combine AOP for transactions and security

Set up the service so only users with the ADMIN role can perform transaction operations.

@Service
public class AdminMoneyTransferService {

    @Autowired
    private MoneyTransferService moneyTransferService;

    @Secured("ROLE_ADMIN")
    public void adminTransfer(Long fromAccount, Long toAccount, Double amount) {
        moneyTransferService.transferMoney(fromAccount, toAccount, amount);
    }
}

Now only an administrator can initiate money transfers between accounts.

Common mistakes when using AOP for transactions and security

• Mistake: calling a transactional method from the same class.

  AOP doesn't work for method calls inside the same class. For example, if you call transferMoney() from another method in the same class, Spring won't apply the proxy and the transactional logic won't run.

  Solution: move transactional methods to a separate bean class or use self-invocation via the Spring context.

• Mistake: incorrect exception handling.

  If you catch an exception inside a transactional method and don't let it propagate, the transaction may commit even though you wanted it rolled back.

  Solution: let exceptions bubble up or explicitly mark the transaction for rollback via TransactionAspectSupport.currentTransactionStatus().setRollbackOnly().

How does this help in real projects?

1. Managing complex transactions: in any financial app keeping data consistent is critical. AOP + transactions help minimize mistakes and reduce boilerplate.
2. Security for enterprise apps: in multi-user systems (like CRM or ERP) AOP is used to enforce access control without sprinkling checks in every method.
3. Easier testing and maintenance: AOP separates cross-cutting concerns from business logic, making code cleaner and more modular.

We went over how AOP in Spring helps simplify transaction and security management. These approaches make code not just cleaner but also easier to maintain, which is super important for complex enterprise apps.