How can a session variable be read in a Spring annotation expression, specifically #PreAuthorize - spring

Question

I'm using the Spring Security #PreAuthorize annotation and it works when I use "known good" expressions that I've seen in the documentation or in other online examples. The example code isn't a real use case it's contrived.
The following expressions are all variations of ones that worked on a method or methods similar in format to the example method below them. These expressions aren't being used at the same time or even the same method they're just displayed here together for simplicity.
#PreAuthorize("hasRole('ROLE_ADMIN')")
#PreAuthorize("hasAuthority('PERM_XYZ') or authentication.principal.id == #ownerId")
#PreAuthorize("hasRole('ROLE_USER') and #someValue == 'testValue'")
public List<Item> getSomeItems(Integer ownerId, String someValue ) {
// code goes here
}
What I would like to be able to do is test a method argument against a session variable in the expression like this:
#PreAuthorize("hasAuthority('PERM_XYZ') or #someValue == session.someOtherValue")
public List<Item> getSomeItems(Integer someValue) {
// code goes here
}
I would have thought that accessing the session in an expression would be a basic task but I haven't found a single example online or even anyone asking how to do it.
I've tried all of the following and many more but they all generate exceptions:
#PreAuthorize("#someValue == #session.someValue")
#PreAuthorize("#someValue == session.someValue")
#PreAuthorize("#someValue == session.getAttribute('someValue')")
#PreAuthorize("#someValue == request.session.someValue")
#PreAuthorize("#someValue == request.session.getAttribute('someValue')")
Everything above is related to Spring Security and the #PreAuthorize annotation but those things really aren't central to question.
I'm aware of many alternatives to accessing the session and have already solved my use case but I'm still wondering if it's possible to access the session via expression in any annotation.
So... can the user session be accessed in a Spring annotation expression and if so how? Thanks.

Answer 1

The spring EL expression for the current is #session.
So you could use
#PreAuthorize("#userId == session.userId")
But this session is the current HttpSession and it has no property userId. According to spring el access you can use authentication or principal
Try
#PreAuthorize("#userId == principal.username")
presuming that the username is the userId...