@WebMvcTest and WebSecurity with @EnableMethodSecurity not looking for @PreAuthorize annotation in the interface

[alexisgayte]

@WebMvcTest and WebSecurity with @EnableMethodSecurity not looking for @PreAuthorize annotation in the interface

[wilkinsona]

Thanks for the sample. It allowed me to determine that this is a duplicate of #33415. You can work around it by importing AOP auto-configuration:

@Import(SecurityConfig.class)
@WebMvcTest(value = HelloController.class)
@ImportAutoConfiguration(AopAutoConfiguration.class)
class HelloControllerTest {

[wilkinsona]

Thanks for the report, but it's not clear to me why you have opened a Spring Boot issue. Spring Boot isn't involved with the discovery of the @PreAuthorize annotations. It's Spring Security that does that. Perhaps you're saying that the problem only occurs with @WebMvcTest and doesn't occur when running the application's main method or perhaps when using @SpringBootTest? If that's the case and you would like us to investigate, please provide a complete yet minimal sample that demonstrates these differences in behaviour. If that's not the case, this should probably be a Spring Security issue as it sounds like it's out of Spring Boot's control.

[alexisgayte]

Yes that is the case it is linked to @WebMvcTest I believe.
Everything works fine otherwise, the app itself is fine.

Here is the test repo : https://github.com/alexisgayte/spring-framework-30489/tree/main

I personally moved the interface into the controller that resolved my issue.
But that looks a bug. May be Spring Security but looks more on @WebMvcTest.

The test fail due to a 404. meaning spring can't find the mapping.

[alexisgayte]

Thanks for your time.