title: Annotated class with @Secured and @PreAuthorize does not secure super methods
body: <p><strong>Situation</strong><br>
  I have created an CrudController which contains some basic crud methods. This works fine. When i want to secure this controller i can override the method from the super class and that works fine. However i don't want to override every method just for security. I want to use @Secured or @PreAuthorize on the class for that.</p>
  
  <p>I'm using Spring Boot 2.2.2 (latest at time of writing). </p>
  
  <p><strong>Example</strong><br>
  <em>Crud base class</em>   </p>
  
  <pre><code>public class CrudController&lt;T, ID&gt; {
      @GetMapping
      public ResponseEntity&lt;List&lt;T&gt;&gt; findAll() {
          // code for returning the list
      }
  }
  </code></pre>
  
  <p><em>Implementing class</em>   </p>
  
  <pre><code>@RestController
  @RequestMapping("/helloworld")
  @Secured("ROLE_world.view") 
  public class HelloWorld extends CrudController&lt;World, Long&gt; {
  
     @GetMapping("test")
     public ResponseEntity test() {
        // This method is secured by the annotation on the class
     }
  
     // the findAll from the super class is not secured
  
  }
  </code></pre>
  
  <p><strong>Expected behaviour</strong><br>
  When a class is annotated with either @PreAuthorize or @Secured i expect that all public methods are secured. So also all public methods from the extended class should be secured. In my example findAll is insecure and that is an high security risk.</p>
  
  <p><strong>Tried</strong><br>
  I already have tried setting the folowing annotations for configuration:</p>
  
  <p>On the class itself:  </p>
  
  <pre class="lang-java prettyprint-override"><code>@Scope( proxyMode = ScopedProxyMode.TARGET_CLASS )
  </code></pre>
  
  <p>On the configuration class:  </p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableAspectJAutoProxy
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(
          prePostEnabled = true,
          securedEnabled = true,
          jsr250Enabled = true,
          mode = AdviceMode.PROXY,
          proxyTargetClass = true
  )
  </code></pre>
  
  <p>In the application.properties:</p>
  
  <pre><code>spring.aop.proxy-target-class=true
  spring.aop.auto=true
  </code></pre>