title: Spring Security endpoint protection by dynamic roles
body: <p>Have a doubt regarding protecting endpoints by user roles. I have a endpoint "/message" it is protected in either of two ways as shown below</p>
  
  <p>1) In Controller as follows</p>
  
  <pre><code>@PreAuthorize("hasAuthority('USER')")
  @RequestMapping(value = "/message", method = RequestMethod.GET)
  public String message() {
      return "Hello World!!!"
  }
  </code></pre>
  
  <p>2) In configuration(WebSecurityConfigurereAdapter) file as follows</p>
  
  <pre><code>@Override
  public void configure(HttpSecurity http) throws Exception {
      http
          .authorizeRequests().anyRequest().authenticated()
          .antMatchers(HttpMethod.GET, "/message").access("hasAuthority('USER')");
  }
  </code></pre>
  
  <p>As it can be seen role USER has been hard coded in both ways, how can this be achieved dynamically, one way is we can read from database in configuration file and build HttpSecurity, but this happens during start of the application, <strong>how can endpoints be protected by new roles created at runtime?</strong></p>