Spring Security @PreAuthorize on controllers -

i'm trying use url (ant based) matching along @preauthorize("permitall") on controllers i.e.

@controller @requestmapping("/register") public class registrationcontroller { ...    @preauthorize("permitall")   @requestmapping(method = requestmethod.get)   public string register() { ... } 

securityconfig:

@configuration @enablewebmvcsecurity @enableglobalmethodsecurity(prepostenabled = true) public class securityconfig extends websecurityconfigureradapter {      @override     protected void configure(httpsecurity http) throws exception {         // @formatter:off         http             .authorizerequests()                 .antmatchers("/").permitall()                 .anyrequest().authenticated() 

i've tried adding @enableglobalmethodsecurity mvc config:

@configuration @enableglobalmethodsecurity(prepostenabled = true) public class mvcconfig extends webmvcconfigureradapter { ... } 

but has no effect

however still prompted authenticate when hitting /register. if add "/register" ant matchers works i.e. .antmatchers("/", "/register").permitall()

what missing here? seems @preauthorize has no effect on controllers

you cannot because ant matchers , @preauthorize work @ different level.

the ant matchers works @ http security level. spring security filter looks @ request, , if find access should denied, not pass request dispatcher servlet, , directly send 403 error.

preauthorize work @ method level. when method called, aop proxy controls if access should allowed. 2 authorizations level chained, instead of second overriding first.

anyway, advice not use @preauthorize("hasrole('admin')") on controller :

• it can done simple ant matcher
• it forces allow proxying on controller, either class proxying instead of jdk proxying or using interfaces controllers

imho, @preauthorize best suited @ service level, because can mix domain objects user granted authorities fine grained authorizations.