java - Spring security - Limiting access to my update profile page -

i using spring security in application , ran problem. application has update profile page. have added preauthorized() request mapping as

@preauthorize("isauthenticated()") @requestmapping (value="/user/{uid}/profile/update", method = get) public string updateprofileview(@modelattribute("form") userprofileform form, @pathvariable ("uid") integer userid, model model){ 

it works fine, , unauthenticated user can not access page.

but issue every authenticated user can access page.

for example : user logged in application, he/she able update every one's profile.

my customuserdetailservice class

@service @transactional public class customuserdetailsservice implements userdetailsservice {  @resource userservice userservice;  @override public userdetails loaduserbyusername(string email) throws usernamenotfoundexception {     com.analyst.future.domain.user user = userservice.getuser(email);      simplegrantedauthority auth = new simplegrantedauthority("role_user");      collection<simplegrantedauthority> authorities = new hashset<simplegrantedauthority>();     authorities.add(auth);      user userdeatails = new user(user.getemail(), user.getpassword(), authorities);     return userdeatails;  }  } 

i don't think can restrict roles every authenticated user have same roles.

is there way can restrict authenticated user access self update profile page.

i no spring security expert, try reading on using expression-based access - link here

there 1 tiny little line matches want -

for example, if wanted particular method allow access user username matched of contact, write

@preauthorize("#contact.name == authentication.name") public void dosomething(contact contact); 

i think in case like

@preauthorize("email == authentication.email") 

this method level though, maybe not looking for? news there way use logged in user , match against request user. :)