My Resource has this code:

    public ResponseEntity<Void> deleteDevice(@PathVariable Long id) {
        log.debug("REST request to delete Device : {}", id);
        return ResponseEntity.noContent().headers(HeaderUtil.createEntityDeletionAlert(applicationName, true, ENTITY_NAME, id.toString())).build();

It is supposed to be executed only by users with 'ROLE_ADMIN'. However, any logged user can run it, even if they don't possess the ROLE_ADMIN authority.

I've also tried by adding


on the SecurityConfiguration, but requests are never blocked. What am I missing? I'm using JHipster 6.9.1

  • Can you add your configuration as well e.g. is prePostEnabled enabled? – sudo Jun 12 '20 at 8:01
  • 1
    Indeed, this was missing. Post as answer so that I can accept it. It is weird however that this is not enabled by default and JHipster docs don't mention it – Centroricerche rps Jun 12 '20 at 14:26

As mentioned in my comment - enable prePostEnabled in your Configuration as well to active the method security:

  prePostEnabled = true, 

Why it isnt't enabled by default by JHipster I don't know

  • Actually, the documentation is correct but this was a bug on JHipster part when using UAA – Centroricerche rps Jun 15 '20 at 13:59

Your Answer

