title: HasAnyAuthority always let me in into the api whenever it is declared to stop the request
body: <p>Going through Spring Security I created a method:</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(securedEnabled = true)
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      @Autowired
      private UserDetailsService userDetailsService;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http
              .csrf().disable()
              .authorizeRequests()
                  .antMatchers("/static/build/app.js", "/static/app/styles/*/**", "/static/app/js/*/**",
                          "/static/build/libs.js", "/index.html", "/static/build/*/**", "/", "/static/**").permitAll()
                  .antMatchers("/auth/**").permitAll()
                  .antMatchers("/api/user/registerClient").permitAll()
                  .antMatchers("/api/user/checklogin/**").permitAll()
                  .antMatchers("/api/user/getAllAdmins").permitAll()
                  .antMatchers("/api/**").hasAnyAuthority(AuthoritiesConstants.CLIENT, AuthoritiesConstants.ADMIN, AuthoritiesConstants.WORKER)
                  .anyRequest().authenticated()
                  .and()
              .formLogin()
                  .loginPage("/")
                  .loginProcessingUrl("/")
                  .permitAll();
  </code></pre>
  
  <p>And example of the controller method:</p>
  
  <pre class="lang-java prettyprint-override"><code>@RequestMapping(value = "/api/vehicle")
  @PreAuthorize("hasAnyAuthority('ADMIN', 'CLIENT')")
  @RequestMapping(value = "", method = RequestMethod.GET)
  public List&lt;VehicleReservationModel&gt; getVehiclesForClientByLogin(HttpServletRequest request) {
      Principal name = request.getUserPrincipal();
      if (name.getName() == null) {
          throw new RuntimeException("Brak sesji");
      }
      if (roleService.getRoleForUserByLogin(name.getName()).toLowerCase().equals("admin")) {
          return vehicleService.getAllVehicles();
      } else {
          List&lt;VehicleReservationModel&gt; vehicleList = vehicleService.getVehiclesForClientByLogin(name.getName());
          if (vehicleList == null) {
              throw new RuntimeException("Brak pojazdów dla klienta " + name.getName() + " - lista jest pusta");
          }
          return vehicleList;
      }
  }
  </code></pre>
  
  <p>The case is whenever I remove the <code>ADMIN</code> from </p>
  
  <pre class="lang-java prettyprint-override"><code>@PreAuthorize("hasAnyAuthority('ADMIN', 'CLIENT')")
  </code></pre>
  
  <p>and comment:</p>
  
  <pre class="lang-java prettyprint-override"><code>.antMatchers("/api/**").hasAnyAuthority(AuthoritiesConstants.CLIENT, AuthoritiesConstants.ADMIN, AuthoritiesConstants.WORKER)
  </code></pre>
  
  <p>it <strong>always</strong> let me in into the API. I thought whenever I create some privilidges, it will always work. Why in above example my Spring Security doesnt work?</p>
  
  <p><strong>UPDATE:</strong>
  The answear is to enable using annotation <code>PreAuthorize</code> you need to add :
  <code>@EnableGlobalMethodSecurity(prePostEnabled = true)</code></p>