#PostAuthorize not working - spring

Question

I'm trying to build a simple handler method that will prevent users to browse item's that belong to different user. The method is below:
#PostAuthorize("principal.username == #model['username']")
#RequestMapping(value = "/show/{id}", method = RequestMethod.GET)
public String single(#PathVariable Long id, Model model) {
Item item = itemService.findById(id);
model.addAttribute("item", item);
model.addAttribute("username", item.getUser().getUsername());
return "item";
}
so the main idea is to compare principal.username with the username stored in the model. I'm using Spring 5.0.5, security 5.0.4. Java Config without boot. My config holds (amnogst other things)
#Configuration
#EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
...
}
and
#Configuration
#EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
#Override
protected MethodSecurityExpressionHandler createExpressionHandler() {
final DefaultMethodSecurityExpressionHandler expressionHandler
= new DefaultMethodSecurityExpressionHandler();
return expressionHandler;
}
}
Despite of this, I'm able to login and than via direct url access items of different user. Any hint is welcome. Thanks

Answer 1

Add this method security config to your project. This configuration act as globally and of-course your proxyTargetClass = true so that, spring can generate proxy for your controller class also.
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
import org.springframework.security.oauth2.provider.expression.OAuth2MethodSecurityExpressionHandler;
#Configuration
#EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
/*
We can enable annotation-based security using the #EnableGlobalMethodSecurity annotation
on any #Configuration instance.
*/
#Override
protected MethodSecurityExpressionHandler createExpressionHandler() {
return new OAuth2MethodSecurityExpressionHandler();
}
}
Hope this will solve your problem.

Answer 2

OK, so in case others experience a same problem. The problem is that I was using a #Pre/#PostAuthorize annotation on a Controller. Controllers are typically not behind an interface, and by the default, the aspect that configure the behaviour didn't kick in.
The solution for me was to #EnableAspectJAutoProxy on a WebConfig class that scan packages in search for controllers:
#Configuration
#EnableWebMvc
#EnableAspectJAutoProxy
#ComponentScan(basePackages = {"rs.saga.web"})
public class WebConfig implements WebMvcConfigurer {
...
}