@EventListener doesn't work when @PreAuthorize is present on any interface method implemented by the same class [SPR-13866]

[spring-projects-issues]

Ruslan Stelmachenko opened SPR-13866 and commented

The @org.springframework.context.event.EventListener annotation doesn't work when @org.springframework.security.access.prepost.PreAuthorize is present on any method of interface implemented by the same class.

Also it is true if @PreAuthorize is present on class method which implements some interface method without annotations.

For example:

public interface MyService {

	@PreAuthorize("hasAuthority('READ_WORKDAY')")
	public void restrictedMethod();

}

@Service
public class MyServiceImpl implements MyService {

	@Override
	public void restrictedMethod() {
	}

	@EventListener
	public void processBlackListEvent(BlackListEvent event) {
		System.out.println("MyServiceImpl processBlackListEvent: " + event);
	}

}

With this code processBlackListEvent method is never called when publishing BlackListEvent. Also we can place @PreAuthorize annotation to the implementation method and remove it from interface. In this case @EventListener also doesn't work.

If we remove @PreAuthorize then it starting to work again.

The old way with implementing ApplicationListener interface and overriding onApplicationEvent method also works fine.

---

Affects: 4.2.2

[spring-projects-issues]

Juergen Hoeller commented

This should work as of 4.2.3, due to the work in #18226: In case of an AOP proxy, we also look at its target class for event listener annotations now.

At this point, please try against 4.2.4 and let me know if something is missing there still.

Juergen

[spring-projects-issues]

Ruslan Stelmachenko commented

I tried it with 4.2.4 and it works now! Thanks!