title: Spring Security | Method level security with @Secured/@PreAuthorize
body: <p>I've been trying out 'Method Level' security on this application I've been working on. The idea is to secure a method which gets called from the presentation layer using DWR.
  Now, I've tried adding the following annotations on my method:</p>
  
  <pre><code>@PreAuthorize("isAuthenticated() and hasRole('ROLE_CUSTOMER')")
  </code></pre>
  
  <p>And corresponding entry in my security context:</p>
  
  <pre><code>&lt;global-method-security pre-post-annotations="enabled" /&gt;
  </code></pre>
  
  <p>On similar lines, I've tried @Secured annotation:</p>
  
  <pre><code>@Secured({"ROLE_CUSTOMER" })
  </code></pre>
  
  <p>And corresponding entry in my security context:</p>
  
  <pre><code>&lt;global-method-security secured-annotations="enabled" /&gt;
  </code></pre>
  
  <p>Ideally, I would expect that if a user is not authenticated, they should be redirected to a 'Sign in' page and the 'ROLES' should not be checked. In this case, even for an unauthenticated user, this method call results in 'AccessDeniedException'. I need it to redirect the user to a login page in such a scenario.</p>
  
  <p>To take it forward, I even tried handling the accessdenied exception by creating a custom AccessDenied Handler. Unfortunately, the handler never got called but the exception was thrown.</p>
  
  <p>Here's the configuration:</p>
  
  <pre><code>&lt;access-denied-handler ref="customAccessDeniedHandler"/&gt;
  </code></pre>
  
  <p>This has a corresponding handler bean defined in the same file.</p>
  
  <p>Still no luck. The accessdeniedhandler never gets called. </p>
  
  <p>Just to summarize the requirement, I need to secure a method. If this method gets called, and the user is unauthenticated the user should get redirected to 'Sign In' page (which as of now is throwing Accessdenied execption). </p>
  
  <p>Appreciate your help folks..</p>
  
  <p><strong>EDIT 1</strong>: Here is a snippet from the security context:</p>
  
  <pre><code>&lt;http&gt;
      &lt;intercept-url pattern="/*sign-in.do*" requires-channel="$secure.channel}" /&gt;
      .....
      ..... 
      .....
      &lt;intercept-url pattern="/j_acegi_security_check.do" requires-channel="${secure.channel}" /&gt;
  
      &lt;intercept-url pattern="/*.do" requires-channel="http"  /&gt;
      &lt;intercept-url pattern="/*.do\?*" requires-channel="http" /&gt;
      &lt;form-login login-page="/sign-in.do" authentication-failure-url="/sign-in.do?login_failed=1"
          authentication-success-handler-ref="authenticationSuccessHandler" login-processing-url="/j_acegi_security_check.do"/&gt;
  
      &lt;logout logout-url="/sign-out.do" logout-success-url="/index.do" /&gt;
  
      &lt;session-management session-authentication-strategy-ref="sessionAuthenticationStrategy" /&gt;
          &lt;access-denied-handler ref="customAccessDeniedHandler"/&gt;
    &lt;/http&gt;
      &lt;beans:bean id="customAccessDeniedHandler" class="com.mypackage.interceptor.AccessDeniedHandlerApp"/&gt;
  </code></pre>