Does Spring Boot enable @PreAuthorize automatically?

No. The Spring Security reference says Spring Boot Starter Security does not activate method level authorization by default. You must add the method security annotation to a configuration class. Without it, annotations such as PreAuthorize sit in your code and are not enforced, which gives a false sense of safety.

The silent failure

Method security lets you protect service methods with annotations, including PreAuthorize, PostAuthorize, PreFilter and PostFilter. A developer adds PreAuthorize with an admin role check to a method, tests happy paths, and ships. If method security was never enabled, any caller who reaches the method can run it.

Nothing fails at startup. No warning appears. Only a negative test, one that expects a forbidden response, reveals the gap.

How to enable it

The reference says to annotate any configuration class with the method security annotation, or use the XML element. Then, in its words, you can immediately annotate any Spring managed class or method.

@Configuration
@EnableMethodSecurity
class MethodSecurityConfig { }

The docs also show that you can turn off the pre and post annotation support with prePostEnabled = false and register only the interceptors you want, for example only PostAuthorize.

Checklist

1. Search for the method security annotation in your code. If it is missing, find every PreAuthorize and decide what each one was meant to protect.
2. Add a test per protected method for an unauthorised caller. It should fail with an access denied result.
3. Apply annotations on Spring managed beans. Annotating a plain object you create with new gives no protection.
4. Do not rely on method security alone. Keep URL level rules in your filter chain as a second layer.
5. Review any use of a custom interceptor setup, which the docs say turns off defaults you do not re-register.
6. Add a review item: every new controller or service method with sensitive behaviour needs an authorization annotation or a documented reason.

Why this belongs in a scanner workflow

Dependency scanners find vulnerable libraries. Missing method security is application logic, found through code review and tests. If you use static analysis, add a rule or a custom check for sensitive methods without an annotation. For broader guidance see Spring Boot security best practices.

Safeguard scans dependencies, produces SBOMs and uses reachability analysis to show which findings your code can actually reach. You can run a free scan at gold.safeguard.sh/scan.

Quick check

Sources

• Method Security, Spring Security reference

Last reviewed: 19 October 2026.