title: Spring Security: Rest endpoint is not found after securing with @Secured
body: <p>I am trying to secure a REST endpoint via the @Secured annotation of Spring Security. My main application (Spring Boot App) with the security config and the rest controller are in different packages and project. </p>
  
  <p>Main app package: com.myapp.api.web</p>
  
  <p>Rest controller packge: com.myapp.api.rest</p>
  
  <p>Mainapp:</p>
  
  <pre><code>@SpringBootApplication
  @ComponentScan(basePackages = "com.myapp.api")
  @EntityScan("com.myapp.api")
  @RestController
  public class ApiApplication extends SpringBootServletInitializer
  {
  public static void main(String[] args)
  {
      SpringApplication.run(ApiApplication.class, args);
  }
  
  @Override
  protected SpringApplicationBuilder configure(SpringApplicationBuilder application)
  {
      return application.sources(ApiApplication.class);
  }
  </code></pre>
  
  <p>}</p>
  
  <p>Security Config:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true, 
  securedEnabled = true)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter
  {
  private static final String USERS_CONFIG_FILE_NAME = "users.yml";
  
  @Override
  protected void configure(HttpSecurity http) throws Exception
  {
      http
          .httpBasic()
          .and()
          .csrf().disable();
  
      http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  }
  
  @Bean
  public PasswordEncoder passwordEncoder()
  {
      return new BCryptPasswordEncoder();
  }
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth,
      InMemoryUserDetailsManager inMemoryUserDetailsManager, PasswordEncoder passwordEncoder) throws Exception
  {
      auth.userDetailsService(inMemoryUserDetailsManager).passwordEncoder(passwordEncoder);
  }
  
  @Bean
  public InMemoryUserDetailsManager inMemoryUserDetailsManager() throws IOException
  {
      return new InMemoryUserDetailsManager(
          PropertiesLoaderUtils.loadAllProperties(USERS_CONFIG_FILE_NAME, getClass().getClassLoader()));
  }
  </code></pre>
  
  <p>}</p>
  
  <p>Rest controller:</p>
  
  <pre><code>@RestController
  public class RestController
  {
  
  private final RestService service;
  
  @PostMapping("/rest/v1")
  @Secured({"ROLE_ADMIN"})
  public List&lt;String&gt; getStates(@RequestBody List&lt;String&gt; Ids)
  {
      ...
  }
  </code></pre>
  
  <p>My rest endpoint is working as long as I am not setting <em>securedEnabled = true</em>. After setting it <em>true</em> I am getting a 404 Not Found as respond message. I've already debugged it and found out that the Spring Security somewhen stops in the filter chain and that the request never reaches the controller. </p>
  
  <p>As far as I tested it, as long as the rest controller is in a different project this error will occure. After moving it to the same project it is working as it should.</p>
  
  <p>Is there something missing in my Securityconfig or what could the problem be?</p>