Secure Spring Boot app with custom scopes/roles
<p>In my Jersey app I’ve used <code>@RolesAllowed("my-scope-or-role-name")</code> together with an implementation of how to read scopes from a request to ensure authorization. E.g. when HTTP header <code>my-role-header</code> had the value <code>my-scope-or-role-name</code> I was processing the request.</p>

<pre><code>@RolesAllowed("my-scope-or-role-name")
public ResponseEntity&lt;Object&gt; post(@RequestBody final String plainText) {
 // process request
}
</code></pre>

<p>As the service was behind a proxy, only this proxy could set the value of <code>my-header</code>, depending on the access token it got. </p>

<p>What is the idiomatic way to resolve this problem in Spring Boot? I also read about using <code>@Secured</code> annotation… But the <code>@RolesAllowed()</code> seems to be pretty straight forward.  </p>