Spring Security SEC-2767: @PreAuthorize in combintation with @ModelAttribute fails

uxbux hulan (Migrated from SEC-2767) said:

using: spring & spring-mvc 4.1.0.RELEASE

when annotated controllers with @ModelAttribute and @PreAuthorize autowired dependencies are null. found out that removing @ModelAttribute works.

Comment From: caboodle

This bug still occurs with Spring Boot 2.7.2.

The methods annotated with @ModelAttribute in the Controller are always called with all ServiceBeans as null, even if the Controller has already used these same beans in other method calls. Removing the PreAuthorize annotations makes the controller work properly again. (Using constructor injection with no no-args constructor defined.)