Spring Security @PreAuthorize does not check if method is public

Summary

I lost some days trying to make Spring Security @PreAuthorize annotation works, and discovered that it was just only because my expose method was "final". Spring should throw an error as it already does when @Configuration annotated classes are final.

Actual Behavior

Final methods annotated with @PreAuthorize are ignored, no error thrown. Changes in software can create security vulnerabilities.

Expected Behavior

When a final method is annotated with @PreAuthorize, Spring must throw an error, Similar when @Configuration in final classes.

Spring 5 is already compatible with Kotlin. Kotlin generates all methods as final by default.

Configuration

Any Spring Security working configuration, with a @RestController exposing Rest methods (@RequestMapping annotated).

Version

Version 5 in a Kotlin project.

Sample

This not works works (no error throwed):

    @PreAuthorize("isAuthenticated()")
    @RequestMapping("/ping", method = arrayOf(RequestMethod.GET))
    fun version(): String { ... }

This Works.

    @PreAuthorize("isAuthenticated()")
    @RequestMapping("/ping", method = arrayOf(RequestMethod.GET))
    open fun version(): String { 

Start by tracing Spring Security method authorization for @PreAuthorize on @RequestMapping methods, comparing proxy handling of final and open methods in a Kotlin project. The work is done when final methods annotated with @PreAuthorize produce the expected error, with coverage for the reported controller configuration.