It's not possible to make blanket statements that say one is better than the other, not in the past, and not now. Both approaches have advantages and drawbacks.
Declarative (or container) security lets you keep just about all handling of users and roles out of the code, using just
Servlet API methods. Thus the code remains completely portable, and everything can be configured outside of the code.
Programmatic security has the advantage of being more flexible. In some cases it is not possible to map user roles to URLs, at least not without looking at URL parameters (which declarative security can't do).
In general, the larger a system is, the more likely it is that you'll run into something that declarative security can't handle, or where you'll need to use a more advanced API like JAAS.
