PreAuthorize not working on Controller

Question

I'm trying to define access rules at method-level but it's not working what so ever.

SecurityConfiguration

@Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true) public class SecurityConfiguration extends WebSecurityConfigurerAdapter {     @Override     public void configure(AuthenticationManagerBuilder auth) throws Exception {         auth.inMemoryAuthentication().                 withUser("user").password("user").roles("USER").and().                 withUser("admin").password("admin").roles("ADMIN");     }     @Override     protected void configure(HttpSecurity http) throws Exception {         http                 .sessionManagement()                 .sessionCreationPolicy(SessionCreationPolicy.STATELESS)                 .and()                 .authorizeRequests()                 .antMatchers("/v2/**").authenticated()                 .and()                 .httpBasic()                 .realmName("Secure api")                 .and()                 .csrf()                 .disable();     } } 

ExampleController

@EnableAutoConfiguration @RestController @RequestMapping({"/v2/"}) public class ExampleController {     @PreAuthorize("hasAuthority('ROLE_ADMIN')")     @RequestMapping(value = "/home", method = RequestMethod.GET)     String home() {         return "Hello World";     } } 

Whenever I try to access /v2/home using user:user it executes just fine, shouldn't it give me an Access Denied error due to 'user' not having ROLE_ADMIN?

I'm actually thinking of ditching access rules at method-level and stick to http() ant rules, but I have to know why it's not working for me.

Answer 1

You have to add @EnableGlobalMethodSecurity(prePostEnabled = true) in your WebSecurityConfig.

You can find it here: http://www.baeldung.com/spring-security-expressions-basic

@Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true) public class WebSecurityConfig extends WebSecurityConfigurerAdapter {