Currently AuthorityAuthorizationManager#isAuthorized uses an inner loop to determine if user has required authority:
private boolean isAuthorized(Authentication authentication) {
for (GrantedAuthority grantedAuthority : authentication.getAuthorities()) {
for (GrantedAuthority authority : this.authorities) {
if (authority.getAuthority().equals(grantedAuthority.getAuthority())) {
return true;
}
}
}
return false;
}
It can be replaced with a Set of authority strings which will be more efficient because HashSet has constant lookup time O(1).