title: Spring security using @security annotation in controller
body: <p>I am working with spring security and create a demo application.It contains one login controller and 2 jsp pages for login and success.</p>
  
  <p>I want to aply method level security in controller using @secure annotation but is is not working, when I apply this in my service class it works well.</p>
  
  <p>Can any one help me to find what wrong I am doing :(</p>
  
  <p>My Pom.xml is </p>
  
  <pre><code>    &lt;?xml version="1.0" encoding="UTF-8"?&gt;
          &lt;project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"&gt;
            &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
            &lt;groupId&gt;com.concretepage.app&lt;/groupId&gt;
              &lt;artifactId&gt;SpringSecurity&lt;/artifactId&gt;
              &lt;packaging&gt;war&lt;/packaging&gt;
              &lt;version&gt;1.0-SNAPSHOT&lt;/version&gt;
              &lt;name&gt;Spring Security App&lt;/name&gt;
  
              &lt;properties&gt;
                  &lt;spring.version&gt;3.1.4.RELEASE&lt;/spring.version&gt;
              &lt;/properties&gt;
  
              &lt;dependencies&gt;
                  &lt;dependency&gt;
                      &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                      &lt;artifactId&gt;spring-core&lt;/artifactId&gt;
                      &lt;version&gt;${spring.version}&lt;/version&gt;
                  &lt;/dependency&gt;
  
                  &lt;dependency&gt;
                      &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                      &lt;artifactId&gt;spring-webmvc&lt;/artifactId&gt;
                      &lt;version&gt;${spring.version}&lt;/version&gt;
                  &lt;/dependency&gt;
  
                  &lt;dependency&gt;
                      &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                      &lt;artifactId&gt;spring-web&lt;/artifactId&gt;
                      &lt;version&gt;${spring.version}&lt;/version&gt;
                  &lt;/dependency&gt;
  
                  &lt;dependency&gt;
                      &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
                      &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt;
                      &lt;version&gt;${spring.version}&lt;/version&gt;
                  &lt;/dependency&gt;
  
                  &lt;dependency&gt;
                      &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
                      &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
                      &lt;version&gt;${spring.version}&lt;/version&gt;
                  &lt;/dependency&gt;
  
                  &lt;dependency&gt;
                      &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
                      &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
                      &lt;version&gt;${spring.version}&lt;/version&gt;
                  &lt;/dependency&gt;
  
                  &lt;dependency&gt;
                    &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                    &lt;artifactId&gt;spring-context&lt;/artifactId&gt;
                    &lt;version&gt;${spring.version}&lt;/version&gt;
                 &lt;/dependency&gt;
  
                 &lt;dependency&gt;
                   &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
                   &lt;artifactId&gt;spring-security-taglibs&lt;/artifactId&gt;
                    &lt;version&gt;${spring.version}&lt;/version&gt;
                 &lt;/dependency&gt;
  
  
                  &lt;dependency&gt;
                      &lt;groupId&gt;jstl&lt;/groupId&gt;
                      &lt;artifactId&gt;jstl&lt;/artifactId&gt;
                      &lt;version&gt;1.2&lt;/version&gt;
                  &lt;/dependency&gt;
  
                  &lt;dependency&gt;
                       &lt;groupId&gt;commons-dbcp&lt;/groupId&gt;
                       &lt;artifactId&gt;commons-dbcp&lt;/artifactId&gt;
                       &lt;version&gt;1.2.2&lt;/version&gt;
                  &lt;/dependency&gt;
  
                  &lt;dependency&gt;
                       &lt;groupId&gt;mysql&lt;/groupId&gt;
                       &lt;artifactId&gt;mysql-connector-java&lt;/artifactId&gt;
                       &lt;version&gt;5.1.17&lt;/version&gt;
                 &lt;/dependency&gt;
  
                 &lt;dependency&gt;
                  &lt;groupId&gt;log4j&lt;/groupId&gt;
                  &lt;artifactId&gt;log4j&lt;/artifactId&gt;
                  &lt;version&gt;1.2.17&lt;/version&gt;
                 &lt;/dependency&gt;
  
                 &lt;dependency&gt;
                   &lt;groupId&gt;org.aspectj&lt;/groupId&gt;
                   &lt;artifactId&gt;aspectjweaver&lt;/artifactId&gt;
                   &lt;version&gt;1.6.8&lt;/version&gt;
                &lt;/dependency&gt;
  
                &lt;dependency&gt;
                  &lt;groupId&gt;javax.servlet&lt;/groupId&gt;
                  &lt;artifactId&gt;servlet-api&lt;/artifactId&gt;
                  &lt;version&gt;2.5&lt;/version&gt;
                &lt;/dependency&gt;
  
                &lt;dependency&gt;
                   &lt;groupId&gt;cglib&lt;/groupId&gt;
                   &lt;artifactId&gt;cglib&lt;/artifactId&gt;
                   &lt;version&gt;2.2&lt;/version&gt;
                 &lt;/dependency&gt;
  
              &lt;/dependencies&gt;
  
              &lt;build&gt;
                  &lt;finalName&gt;SpringSecurity&lt;/finalName&gt;
                  &lt;plugins&gt;
                      &lt;plugin&gt;
                          &lt;artifactId&gt;maven-compiler-plugin&lt;/artifactId&gt;
                          &lt;configuration&gt;
                              &lt;source&gt;1.6&lt;/source&gt;
                              &lt;target&gt;1.6&lt;/target&gt;
                          &lt;/configuration&gt;
                      &lt;/plugin&gt;
                  &lt;/plugins&gt;
              &lt;/build&gt;
  
          &lt;/project&gt;
  </code></pre>
  
  <p>dispatcher-servlet is:</p>
  
  <pre><code>        &lt;beans xmlns="http://www.springframework.org/schema/beans"
          xmlns:context="http://www.springframework.org/schema/context"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://www.springframework.org/schema/beans     
              http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
              http://www.springframework.org/schema/context 
              http://www.springframework.org/schema/context/spring-context-    3.1.xsd"&gt;
  
          &lt;context:component-scan    base-package="com.concretepage.security.controller" /&gt;
  
          &lt;bean     class="org.springframework.web.servlet.view.InternalResourceViewResolver"&gt;
            &lt;property name="prefix" value="/pages/"/&gt;
            &lt;property name="suffix" value=".jsp"/&gt; 
          &lt;/bean&gt;
  
      &lt;/beans&gt;
  </code></pre>
  
  <p>security-config is:</p>
  
  <pre><code>        &lt;?xml version="1.0" encoding="UTF-8"?&gt;
          &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
           xmlns:beans="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://www.springframework.org/schema/beans
                 http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                 http://www.springframework.org/schema/security
                 http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
          &lt;http auto-config="true"&gt;
              &lt;intercept-url pattern="/login" access="ROLE_USER,ROLE_ADMIN" /&gt;
              &lt;logout logout-success-url="/login" /&gt;
          &lt;/http&gt;
  
          &lt;authentication-manager&gt;
            &lt;authentication-provider&gt;
             &lt;user-service&gt;
              &lt;user name="ram" password="con1234" authorities="ROLE_ADMIN" /&gt;
              &lt;user name="rahim" password="con1234" authorities="ROLE_USER" /&gt;
            &lt;/user-service&gt;
            &lt;/authentication-provider&gt;
          &lt;/authentication-manager&gt;
  
         &lt;global-method-security secured-annotations="enabled" /&gt;
         &lt;beans:bean name="userService" class="com.concretepage.service.UserService"/&gt;             
      &lt;/beans:beans&gt;
  </code></pre>
  
  <p>web.xml is:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="ISO-8859-1" ?&gt;
  &lt;web-app xmlns="http://java.sun.com/xml/ns/j2ee"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
      version="2.4"&gt;
  
      &lt;display-name&gt;Spring Security Application&lt;/display-name&gt;
  
      &lt;servlet&gt;
          &lt;servlet-name&gt;dispatcher&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;dispatcher&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
             /WEB-INF/dispatcher-servlet.xml,
             /WEB-INF/security-config.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
        &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.security.web.session.HttpSessionEventPublisher&lt;/listener-class&gt;
       &lt;/listener&gt;
  
      &lt;!-- Spring Security Configuration --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p>LoginController is:</p>
  
  <pre><code>        package com.concretepage.security.controller;
  
      import org.springframework.beans.factory.annotation.Autowired;
      import org.springframework.stereotype.Controller;
      import org.springframework.ui.ModelMap;
      import org.springframework.web.bind.annotation.RequestMapping;
      import org.springframework.web.bind.annotation.RequestMethod;
      import org.springframework.security.access.annotation.Secured;
      import com.concretepage.service.IUserService;
  
      @Controller
      public class LoginController {
          @Autowired
          public IUserService userService;
  
         @RequestMapping(value="/login", method = RequestMethod.GET)
          public String success(ModelMap map) {       
              return "success"; 
          }  
  
         @Secured("ROLE_ADMIN")
         @RequestMapping(value="/test", method = RequestMethod.GET)
          public String success1(ModelMap map) {      
              return "success"; 
          } 
      }
  </code></pre>