title: PreAuthorize annotations on Spring controllers are ignored when testing
body: <p>I'm testing my Spring MVC controllers using JUnit, Mockito &amp; spring-test. Unfortunately, the tests are ignoring the @PreAuthorize annotations on my controller methods, and I've been unable to resolve this. Key code snippets are below, though I've removed irrelevant logic for mocking responses from MyController's dependencies to keep it short. I'm using Spring 3.2 &amp; JUnit 4, and I'm running the tests both via Maven and directly through Eclipse (Run as -> JUnit test).</p>
  
  <p>Right now I am expecting the <i>getAccounts_ReturnsOkStatus</i> test to fail, as I have not provided any auth and the method that the /accounts route maps onto is annotated with a pre-auth annotation, however the method is being invoked and the pre-auth check bypassed.</p>
  
  <p><b>MyControllerTest.java</b></p>
  
  <pre><code>@RunWith(SpringJUnit4ClassRunner.class)
  @ContextConfiguration(locations = { "classpath:applicationContext-test.xml" })
  public class MyControllerTest {
  
      private MockMvc mockMvc;
  
      @Mock
      private MyService myService;
  
      @InjectMocks
      private MyController myController;
  
      @Before
      public void init() {
          MockitoAnnotations.initMocks(this);  
          mockMvc = MockMvcBuilders.standaloneSetup(myController).build();
      }
  
     @Test
     public void getAccounts_ReturnsOkStatus() throws Exception {
         // Make the GET request, and verify that it returns HttpStatus.OK (200)
         mockMvc.perform(MockMvcRequestBuilders.get("/accounts"))
                .andExpect(MockMvcResultMatchers.status().isOk());
     }
  }
  </code></pre>
  
  <p><b>applicationContext-test.xml</b></p>
  
  <pre><code>&lt;sec:global-method-security pre-post-annotations="enabled" /&gt;
  &lt;bean id="applicationContextProvider" class="com.myapp.springsupport.ApplicationContextProvider" /&gt;
  
  &lt;sec:authentication-manager alias="authenticationManager"&gt;
     &lt;sec:authentication-provider&gt;
         &lt;sec:user-service&gt;
             &lt;sec:user name="test-superuser" password="test-pwd" authorities="ROLE_SUPERUSER" /&gt;
         &lt;/sec:user-service&gt;
     &lt;/sec:authentication-provider&gt;
  &lt;/sec:authentication-manager&gt;
  </code></pre>
  
  <p><b>MyController.java</b></p>
  
  <pre><code>@PreAuthorize("isAuthenticated() and hasRole('ROLE_SUPERUSER')")
  @RequestMapping(value = "/accounts", method = RequestMethod.GET)
  @ResponseBody
  public Collection&lt;Account&gt; getAccounts() {
      return new ArrayList&lt;Account&gt;();
  }
  </code></pre>
  
  <p>The applicationContext-test app context is definitely being used, since manually authenticating using</p>
  
  <pre><code>Authentication auth = new UsernamePasswordAuthenticationToken(name, password);
  SecurityContextHolder.getContext().setAuthentication(am.authenticate(auth));
  </code></pre>
  
  <p>only works with the user credentials specified in the test config (in the absence of any other authentication-provider). Additionally, I can be sure that the pre-auth is being ignored, since I've tested using SEL to invoke a method &amp; debugged.</p>
  
  <p>What am I missing?</p>