title: What are the right configurations for global method security with Spring Security 3.2.4 for Jersey 2.9 REST services?
body: <p>I'm trying to configure my Jersey REST services to be secured with global method security provided by Spring. I think I'm missing something in the whole picture. Here are pieces of my code:</p>
  
  <p>My security configuration class (I'm trying to do this purely in java code, one of the problems is that most examples are with .xml configurations):</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class GlobalMethodSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth)
              throws Exception {
          auth.inMemoryAuthentication().withUser("user").password("password")
                  .roles("USER");
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests().anyRequest().permitAll();
      }
  
      @Bean
      @Override
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  }
  </code></pre>
  
  <p>The web security is initialized via:</p>
  
  <pre><code>public class WebSecurityInitializer extends
          AbstractSecurityWebApplicationInitializer {
  }
  </code></pre>
  
  <p>(This actually is the same as adding spring filter in the web.xml.)</p>
  
  <p>Methods with annotation <code>@PreAuthorized("permitAll")</code> are opened correctly. But when I open an URL which is mapped to a method annotated with <code>@PreAuthorized("hasRole('ROLE_USER')")</code>, I get this exception:</p>
  
  <pre><code>java.lang.IllegalStateException: Cannot create a session after the response has been committed
      org.apache.catalina.connector.Request.doGetSession(Request.java:2934)
      org.apache.catalina.connector.Request.getSession(Request.java:2310)
      org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:897)
      org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:909)
      javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:238)
      javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:238)
      javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:238)
      org.springframework.security.web.savedrequest.HttpSessionRequestCache.saveRequest(HttpSessionRequestCache.java:40)
      org.springframework.security.web.access.ExceptionTranslationFilter.sendStartAuthentication(ExceptionTranslationFilter.java:184)
      org.springframework.security.web.access.ExceptionTranslationFilter.handleSpringSecurityException(ExceptionTranslationFilter.java:168)
      org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:131)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:154)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:85)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:57)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
      org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
      org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344)
      org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261)
  </code></pre>