title: PreAuthorize does not work in spring security
body: <p>Why <code>@PreAuthorize</code> doesn't work? It does not throw any exceptions or errors. I have been struggling with this task for several days. I've tried many options but It doesn't work.</p>
  <p>I will be very grateful to anyone who can help solve this <a href="https://github.com/romanych2021/TestPreAuthorize" rel="nofollow noreferrer">problem</a>.</p>
  <p><strong>SecurityConfig.java</strong></p>
  <pre><code>    package com.testpreauthorize.security;
  
      import org.springframework.beans.factory.annotation.Autowired;
      import org.springframework.context.annotation.ComponentScan;
      import org.springframework.context.annotation.Configuration;
      import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
      import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
      import org.springframework.security.config.annotation.web.builders.HttpSecurity;
      import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
      import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
      import org.springframework.security.core.userdetails.UserDetailsService;
  
      @Configuration
      @EnableWebSecurity
      @EnableGlobalMethodSecurity(prePostEnabled = true)
      public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
          @Autowired
          UserDetailsService userDetailsService;
  
          @Autowired
          protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
              auth.userDetailsService(userDetailsService);
          }
  
  
  
  
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http
                      .authorizeRequests()
                      .anyRequest()
                      .permitAll()
  
  
                      .and()
                      .formLogin()
                      .loginPage(&quot;/login&quot;)
                      .loginProcessingUrl(&quot;/login&quot;)
  
                      .defaultSuccessUrl(&quot;/&quot;)
  
                      .and()
  
                      .logout()
                      .permitAll()
                      .logoutUrl(&quot;/logout&quot;)
                      .logoutSuccessUrl(&quot;/&quot;)
  
                      .invalidateHttpSession(true)
                      .deleteCookies(&quot;JSESSIONID&quot;)
                      .and()
                      .csrf().disable();
  
          }
  
  
      }
  </code></pre>
  <p><strong>HomeController.java</strong></p>
  <pre><code>    package com.testpreauthorize.controller;
  
      import org.springframework.security.access.prepost.PreAuthorize;
      import org.springframework.stereotype.Controller;
      import org.springframework.web.bind.annotation.GetMapping;
      import org.springframework.web.bind.annotation.PostMapping;
  
      @Controller
      public class HomeController {
  
          @GetMapping(value = &quot;/&quot;)
          public String home () {
              return &quot;/home&quot;;
          }
  
  
          @PreAuthorize(&quot;isAuthenticated()&quot;)
          @GetMapping(value = &quot;/user&quot;)
          public String user () {
              return &quot;/user&quot;;
  
          }
  
  
          @GetMapping(value = &quot;/login&quot;)
          public String loginGet () {
              return &quot;/login&quot;;
          }
  
          @PostMapping(value = &quot;/login&quot;)
          public String loginPost () {
              return &quot;redirect:/user&quot;;
          }
  
  
      }
  </code></pre>