DefaultMethodSecurityExpressionHandler can't be extended anymore ?

[mfrechePgest]

Upgrading to Spring Security 6, it seems I can't use my own SecurityExpressionRoot like i previously did.

Describe the bug

I used to extend DefaultMethodSecurityExpressionHandler, overwriting createSecurityExpressionRoot to specify my own SecurityExpressionRoot.

But method isn't invoked anymore.
DefaultMethodSecurityExpressionHandler and its callers migrated to functional-style, and there is a second createSecurityExpressionRoot taking Supplier as parameter.

New method is private so I can't overwrite it anymore.

To Reproduce

My 5.x code used to do exactly what Baeldung told me to do :) :
In his sample code, he created a CustomMethodSecurityExpressionHandler kinda like me and overwrite createSecurityExpressionRoot.
Can't setup the same kind of configuration with the new version, because overwritten method isn't invoked anymore.

Expected behavior

I guess the second createSecurityExpressionRoot should be protected as well, so we still could setup our own SecurityExpressionRoot and overwrite the method taking Supplier<Authentication> as param.

Documentation doesn't provides any other way to do the same thing https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html
There may be a new way to inject our own SecurityExpressionRoot, but I didn't find it... And in this case my issue shouldn't be set as a "Bug".

[jzheaux]

Thanks, @mfrechePgest, for reaching out and for updating to Spring Security 6. We introduced some breaking changes in this major release, and this is one of them. Please see #12331 for details.