Open
Description
Expected Behavior
When a user annotates a configuration class with @EnableGlobalMethodSecurity in Spring Security 6.x, the framework should either:
-
Automatically register the method-security infrastructure (metadata source, interceptor, expression handler), or
-
Emit a clear startup warning or error indicating that @EnableGlobalMethodSecurity is deprecated and pointing to the new @EnableMethodSecurity annotation.
Current Behavior
In Spring Security 6.2.7, if you only supply @EnableGlobalMethodSecurity, no method-security beans (e.g. MethodSecurityInterceptor) are registered, and no warning or error is logged. As a result, annotations like @PreAuthorize silently have no effect.