title: Spring Security - @Secured works only in mvc Controller
body: <p><br>
  I am using Spring Security + MVC.<br>
  The annotation <code>@Secured({ "ROLE_ADMIN" })</code> works fine only in the controller layer.<br>
  If I try to use it in deeper/other layers, I get no security error.<br>
  Or if i am trying to use it on "none mvc mapped" methods, I get no security error.<br>
  following my xml's config files:<br>
  <strong>web.xml:</strong>  </p>
  
  <pre><code>  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app id="WebApp_ID" version="2.4"
      xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
          /WEB-INF/spring-security.xml
          /WEB-INF/applicationContext.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;log4jConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/classes/log4j-myapp.properties&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/Management/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p><strong>spring-servlet.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
      xmlns:context="http://www.springframework.org/schema/context"
      xsi:schemaLocation="http://www.springframework.org/schema/beans 
          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
           http://www.springframework.org/schema/context
          http://www.springframework.org/schema/context/spring-context-3.0.xsd"&gt;
  
      &lt;!-- Declare a view resolver --&gt;
      &lt;bean id="viewResolver"
      class="org.springframework.web.servlet.view.InternalResourceViewResolver"
      p:prefix="/WEB-INF/pages/" p:suffix=".jsp" /&gt;
       &lt;context:component-scan base-package="com.affiliates" /&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>spring-security.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
      xsi:schemaLocation="http://www.springframework.org/schema/beans 
              http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
              http://www.springframework.org/schema/security 
  
              http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;
      &lt;security:global-method-security secured-annotations="enabled" /&gt;
      &lt;security:http auto-config="true" use-expressions="true"
          access-denied-page="/Management/auth/denied"&gt;
  
          &lt;security:intercept-url pattern="/Management/auth/login"
              access="permitAll" /&gt;
          &lt;security:intercept-url pattern="/Management/main/admin"
              access="hasRole('ROLE_EMPLOYEE')" /&gt;
          &lt;security:intercept-url pattern="/Management/api/affiliates/**"
              access="hasRole('ROLE_EMPLOYEE')" /&gt;
  
          &lt;security:form-login login-page="/Management/auth/login/"
              authentication-failure-url="/Management/auth/login?error=true"
              login-processing-url="/Management/auth/j_spring_security_check"
              default-target-url="/Management/auth/login?error=false" /&gt;
          &lt;security:logout invalidate-session="true"
              logout-success-url="/Management/auth/login/" logout-url="/Management/auth/logout" /&gt;
      &lt;/security:http&gt;
  
      &lt;security:authentication-manager&gt;
          &lt;security:authentication-provider
              user-service-ref="customUserDetailsService"&gt;
              &lt;security:password-encoder ref="passwordEncoder" /&gt;
          &lt;/security:authentication-provider&gt;
      &lt;/security:authentication-manager&gt;
  
      &lt;bean
          class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"
          id="passwordEncoder" /&gt;
      &lt;bean id="customUserDetailsService" class="com.affiliates.service.CustomUserDetailsService" /&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>mvc-dispacher-servlet.xml</strong></p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
      xsi:schemaLocation="http://www.springframework.org/schema/beans 
      http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
      http://www.springframework.org/schema/context
      http://www.springframework.org/schema/context/spring-context-2.5.xsd"&gt;
  
      &lt;context:component-scan base-package="com.affiliates.controllers" /&gt;
  
      &lt;bean id="viewResolver"
          class="org.springframework.web.servlet.view.InternalResourceViewResolver"&gt;
          &lt;property name="prefix"&gt;
              &lt;value&gt;/WEB-INF/pages/&lt;/value&gt;
          &lt;/property&gt;
          &lt;property name="suffix"&gt;
              &lt;value&gt;.jsp&lt;/value&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>applocationContext.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
      xmlns:mvc="http://www.springframework.org/schema/mvc"
      xsi:schemaLocation="http://www.springframework.org/schema/beans 
              http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
              http://www.springframework.org/schema/context
              http://www.springframework.org/schema/context/spring-context-3.0.xsd
              http://www.springframework.org/schema/mvc 
              http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd"&gt;
  
      &lt;!-- Activates various annotations to be detected in bean classes --&gt;
      &lt;context:annotation-config /&gt;
  
      &lt;!-- Scans the classpath for annotated components that will be auto-registered 
          as Spring beans. For example @Controller and @Service. Make sure to set the 
          correct base-package --&gt;
      &lt;context:component-scan base-package="com.affiliates" /&gt;
  
      &lt;!-- Configures the annotation-driven Spring MVC Controller programming 
          model. Note that, with Spring 3.0, this tag works in Servlet MVC only! --&gt;
      &lt;mvc:annotation-driven /&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>Here is how i use it:
  the secured method:</p>
  
  <pre><code> @Component
      public  class BrandsApi{
      @Secured({ "ROLE_ADMIN" })
          public ResultContainer getAll() {
              return brandDao.getAll(getSecurityFilter().getBrandSecurityFilter());
          }
      }
  }
  </code></pre>
  
  <p>The caller:</p>
  
  <pre><code>@Controller
  @RequestMapping("/api/brands")
  public class BrandsController {
  @RequestMapping(value = "/get")
      public ModelAndView get(){
         BrandsApi brandsApi = new BrandsApi();
         brandsApi.getAll();
  }
  }
  </code></pre>
  
  <p><strong>So this is my latest update</strong>:<br>
  Hi,<br>
  I have a converted my config into javaconfig file that is working fine.<br>
  i debug my application in loading time and i see that the parameter is been transfered.<br>
  meaning that the brandsApi is initialized<br>
  Code:  </p>
  
  <pre><code>@Configuration
  public class SpringJavaConfig { 
      @Bean
      public BrandsApi brandsApi(){
          return new BrandsApi();
      }
  }
  </code></pre>
  
  <p>inside BrandsApi I have a method with @Secured({ "ROLE_ADMIN" }) above it</p>
  
  <p>this is how i call the method:
  Code:</p>
  
  <pre><code>ApplicationContext ctx = new AnnotationConfigApplicationContext(SpringJavaConfig.class);
      BrandsApi brandsApi = (BrandsApi)ctx.getBean(BrandsApi.class);
          brandsApi.getAll();
  </code></pre>
  
  <p>but for some reason i can get inside even though I have logged in ROLE_EMPLOYEE<br>
  this is my BrandsApi class:<br>
  Code:  </p>
  
  <pre><code>class BrandsApi extends BaseApi{
      @Secured({ "ROLE_ADMIN" })
      public void getAll() {
          System.out.println("Hello");
      }
  }
  </code></pre>