SEC-2767: @PreAuthorize in combintation with @ModelAttribute fails

[spring-projects-issues]

uxbux hulan (Migrated from SEC-2767) said:

using: spring & spring-mvc 4.1.0.RELEASE

when annotated controllers with @ModelAttribute and @PreAuthorize autowired dependencies are null. found out that removing @ModelAttribute works.

[caboodle]

This bug still occurs with Spring Boot 2.7.2.

The methods annotated with @ModelAttribute in the Controller are always called with all ServiceBeans as null, even if the Controller has already used these same beans in other method calls. Removing the PreAuthorize annotations makes the controller work properly again. (Using constructor injection with no no-args constructor defined.)