Spring Security @PreAuthorize not working in Spring Security 6+ due to deprecation

Expected Behavior

When a user annotates a configuration class with @EnableGlobalMethodSecurity in Spring Security 6.x, the framework should either:

• Automatically register the method-security infrastructure (metadata source, interceptor, expression handler), or

• Emit a clear startup warning or error indicating that @EnableGlobalMethodSecurity is deprecated and pointing to the new @EnableMethodSecurity annotation.

Current Behavior

In Spring Security 6.2.7, if you only supply @EnableGlobalMethodSecurity, no method-security beans (e.g. MethodSecurityInterceptor) are registered, and no warning or error is logged. As a result, annotations like @PreAuthorize silently have no effect.

Comment From: jzheaux

Hi, @armorcodehemant, can you please provide a sample that reproduces this behavior as this may be a bug? IIRC, the intent of @EnableGlobalMethodSecurity is to throw an exception if no SecurityMetadataSource can be derived from the configuration.