title: Spring Security: Why is my custom AccessDecisionVoter not invoked
body: <p>I'm trying to do URL authorization using a custom <code>AccessDecisionVoter</code>. I don't get any errors and debugging shows that my voter is picked up at start up. However, at runtime, the <code>vote</code> method is not called, thus allowing every authenticated user full access.</p>
  
  <p>Note that, I don't need method security. I'm also not using XML config. That rules out every example ever posted on the internet regarding this topic.</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableWebMvc
  @ComponentScan
  @Order(-10)
  public class HttpSecurityConfig extends WebSecurityConfigurerAdapter {
      @Value("${trusted_ports}")
      private List&lt;Integer&gt; trustedPorts;
  
      @Autowired
      private UserDetailsService userDetailsService;
  
      @Autowired
      private ServiceIdAwareVoter serviceIdAwareVoter;
  
      RequestMatcher requestMatcher = new OrRequestMatcher(
          // @formatter:off
          new AntPathRequestMatcher("/**", GET.name()),
          new AntPathRequestMatcher("/**", POST.name()), 
          new AntPathRequestMatcher("/**", DELETE.name()),
          new AntPathRequestMatcher("/**", PATCH.name()), 
          new AntPathRequestMatcher("/**", PUT.name())
          // @formatter:on
      );
  
      @Override
      protected UserDetailsService userDetailsService() {
          return userDetailsService;
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.authenticationProvider(preAuthProvider());
          auth.authenticationProvider(authProvider());
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          // @formatter:off
          http.
              httpBasic().and().
              authorizeRequests().anyRequest().fullyAuthenticated().
              accessDecisionManager(accessDecisionManager()).and().
              csrf().disable().
              logout().disable().
              exceptionHandling().and().
              sessionManagement().sessionCreationPolicy(STATELESS).and().
              anonymous().disable().
              addFilterAfter(preAuthFilter(), X509AuthenticationFilter.class).
              addFilter(authFilter());
          // @formatter:on
      }
  
      AccessDecisionManager accessDecisionManager() {
          return new UnanimousBased(ImmutableList.of(serviceIdAwareVoter));
      }
  
      Filter preAuthFilter() throws Exception {
          PreAuthenticationFilter preAuthFilter = new PreAuthenticationFilter(trustedPorts);
  
          preAuthFilter.setAuthenticationManager(super.authenticationManager());
  
          return preAuthFilter;
      }
  
      PreAuthenticatedAuthenticationProvider preAuthProvider() {
          PreAuthenticatedAuthenticationProvider preAuthProvider = new PreAuthenticatedAuthenticationProvider();
          UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt; userDetailsServiceWrapper = new UserDetailsByNameServiceWrapper&lt;&gt;();
  
          userDetailsServiceWrapper.setUserDetailsService(userDetailsService());
  
          preAuthProvider.setPreAuthenticatedUserDetailsService(userDetailsServiceWrapper);
  
          return preAuthProvider;
      }
  
      Filter authFilter() throws Exception {
          AppIdAppKeyAuthenticationFilter authFilter = new AppIdAppKeyAuthenticationFilter(requestMatcher);
          authFilter.setAuthenticationFailureHandler(new ExceptionStoringAuthenticationFailureHandler());
          authFilter.setAuthenticationSuccessHandler(new UrlForwardingAuthenticationSuccessHandler());
  
          authFilter.setAuthenticationManager(authenticationManagerBean());
  
          return authFilter;
      }
  
      AuthenticationProvider authProvider() {
          AppIdAppKeyAuthenticationProvider authProvider = new AppIdAppKeyAuthenticationProvider();
          authProvider.setUserDetailsService(userDetailsService());
  
          return authProvider;
      }
  </code></pre>