Can Spring Security use @PreAuthorize on Spring controllers methods?

Yes, it works fine.

You need <security:global-method-security pre-post-annotations="enabled" /> in ...-servlet.xml. It also requires CGLIB proxies, so either your controllers shouldn’t have interfaces, or you should use proxy-target-class = true.

Leave a Comment