In my case im using @EnableMethodSecurity(prePostEnabled = true) for prepost filter on controller
in SecurityConfig.java
@Configuration
@EnableMethodSecurity(prePostEnabled = true)
public class SecurityConfig {
@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(autz -> autz
.anyRequest().authenticated())
.csrf(csrf -> csrf.disable())
.sessionManagement(httpSecuritySessionManagementConfigurer -> httpSecuritySessionManagementConfigurer
.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.httpBasic(Customizer.withDefaults());
return http.build();
}
}On my Controller
@PreAuthorize("isAuthenticated()")
@GetMapping("/book")
public ResponseEntity<Page<Book>> findAll() {
....
}
@PreAuthorize("hasAnyRole('ADMIN', 'SUPERADMIN')")
@PostMapping("/book")
public ResponseEntity<Page<Book>> findAll() {
....
}