title: Spring Security method security not working: PreAuthorize allowing all users instead of limited users
body: <p>I am trying to implement method level security using spring security. I have annotated 2 separate methods with the <code>@PreAuthorize</code> annotation. In this example, I have 2 users ADMIN and USER. And I have restricted 2 methods both to each of the users. When I try logging in as USER I am able to access both the endpoint restricted to USER (<code>getSomeTextForUser()</code>) as well as to ADMIN(<code>getSomeTextForAdmin()</code>). So this is definitely not right and after viewing multiple tutorials I have not seen the error in my ways.</p>
  <p><strong>Expected behavior:</strong> person logged in as USER should get an error when trying to access the endpoint <code>/test/admin</code> since it calls <code>getSomeTextForAdmin()</code>. And the similar behavior should happen for the admin when calling <code>/test/user</code> since it calls <code>getSomeTextForUser()</code>.</p>
  <p>Main class</p>
  <pre><code>@SpringBootApplication
  public class App {
  
      public static void main(String[] args) {
          SpringApplication.run(App.class, args);
      }
  
  }
  </code></pre>
  <p>My controller class</p>
  <pre><code>@RestController
  public class UserController {
  
      @GetMapping(&quot;/&quot;)
      public String home() {
          return (&quot;&lt;h1&gt; Welcome &lt;/h1&gt;&quot;);
      }
  
      @GetMapping(&quot;/test/admin&quot;)
      public String test() {
          return getSomeTextForAdmin();
      }
  
      @GetMapping(&quot;/test/user&quot;)
      public String test2() {
          return getSomeTextForUser();
      }
  
      @PreAuthorize(&quot;hasRole('ROLE_ADMIN')&quot;)
      public String getSomeTextForAdmin() {
          return &quot;For Admin Only!&quot;;
      }
  
      @PreAuthorize(&quot;hasRole('ROLE_USER')&quot;)
      public String getSomeTextForUser() {
          return &quot;For User Only!&quot;;
      }
  
  }
  </code></pre>
  <p>The security configuration where I've enabled the prePost feature</p>
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      UserDetailsService userDetailsService;
  
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userDetailsService);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .antMatchers(&quot;/test&quot;).hasAnyRole(&quot;ADMIN&quot;, &quot;USER&quot;)
                  .antMatchers(&quot;/&quot;).permitAll()
                  .and().formLogin();
  
  
      @Bean
      public PasswordEncoder getPasswordEncoder() {
          return NoOpPasswordEncoder.getInstance();
      }
  
  
  }
  </code></pre>
  <p>My User details service where I've just placed some default users in memory on startup for testing.</p>
  <pre><code>@Repository
  public class UserRepositoryImpl implements UserRepository {
  
      Map&lt;String, User&gt; users = new HashMap&lt;&gt;();
  
      public UserRepositoryImpl() {
          createDefaultUsers();
      }
  
      @Override
      public Optional&lt;User&gt; findByUserName(String userName) {
          return Optional.of(users.get(userName));
      }
  
      private void createDefaultUsers() {
          users.put(&quot;admin&quot;, new User(&quot;admin&quot;, &quot;pass&quot;, &quot;ADMIN&quot;));
          users.put(&quot;user&quot;, new User(&quot;user&quot;, &quot;pass&quot;, &quot;USER&quot;));
      }
  }
  </code></pre>
  <p>MyUserDetails is here</p>
  <pre><code>public class MyUserDetails implements UserDetails {
  
      private final String userName;
      private final String password;
  
      private final List&lt;GrantedAuthority&gt; authorities;
  
      public MyUserDetails(User user) {
  
          this.userName = user.getUserName();
          this.password = user.getPassword();
          this.authorities = Arrays.stream(user.getRoles().split(&quot;,&quot;))
                  .map(SimpleGrantedAuthority::new)
                  .collect(Collectors.toList());
  
      }
  
      @Override
      public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
          return authorities;
      }
  
      @Override
      public String getPassword() {
          return password;
      }
  
      @Override
      public String getUsername() {
          return userName;
      }
  
      @Override
      public boolean isAccountNonExpired() {
          return true;
      }
  
      @Override
      public boolean isAccountNonLocked() {
          return true;
      }
  
      @Override
      public boolean isCredentialsNonExpired() {
          return true;
      }
  
      @Override
      public boolean isEnabled() {
          return true;
      }
  }
  </code></pre>
  <p>And the user class itself</p>
  <pre><code>@Entity
  @Table(name = &quot;User&quot;)
  public class User {
  
      public User(String userName, String password, String roles) {
          this.userName = userName;
          this.password = password;
          this.roles = roles;
      }
  
  
      @Id
      @GeneratedValue(strategy = GenerationType.AUTO)
      private int id;
  
      public int getId() {
          return id;
      }
  
      public void setId(int id) {
          this.id = id;
      }
  
      public String getUserName() {
          return userName;
      }
  
      public void setUserName(String userName) {
          this.userName = userName;
      }
  
      public String getPassword() {
          return password;
      }
  
      public void setPassword(String password) {
          this.password = password;
      }
  
      public boolean isActive() {
          return active;
      }
  
      public void setActive(boolean active) {
          this.active = active;
      }
  
      public String getRoles() {
          return roles;
      }
  
      public void setRoles(String roles) {
          this.roles = roles;
      }
  
      private String userName;
      private String password;
      private boolean active;
      private String roles;
  
  
  }
  </code></pre>