Securing a SimpleFormController

[keith123]

Maybe I am missing something but I read the FAQ's on securing controller methods and I implemented the solution, however my annotation is not working on SimpleFormController types it is only working on annotated ones. How would I wire this to work for both types of controllers (old and new).

servlet.xml

	<sec:global-method-security pre-post-annotations="enabled">
	 	 <sec:expression-handler ref="expressionHandler"/> 
	 </sec:global-method-security>

Works:

@RequestMapping(method=RequestMethod.GET)
@PreAuthorize("hasAuthority('ROLE_BOGUS')")
public void form(HttpSession session, Model model) {

Doesn't Work (SimpleFormController)

@PreAuthorize("hasAuthority('ROLE_BOGUS')")
protected Object formBackingObject(HttpServletRequest request)

Thanks,

Keith

[Marten Deinum]

I suggest you read the Spring AOP chapter especially the part that explains about proxies...

Basically the only method to secure on old style controllers is handleRequest as that is the only public called method and because aop is based on proxies that is the only method that is being proxied all other calls are internal method calls.