我在我的spring boot应用程序中使用openid和spring boot security进行了安全设置。
由于偶然的原因，我忘了将角色类型添加到我的 @PreAuthorize("hasAnyRole('...)") 标记并尝试打电话作为 USER 并被拒绝（403），但我确实在我的securityconfig文件中声明了hasanyrole。一旦我将角色添加到preauth标记中，它就工作了，但我想知道这是否是预期的行为？还是我在安全配置文件中做错了什么？
我正在使用以下spring boot安全设置

<dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security.oauth.boot</groupId>
            <artifactId>spring-security-oauth2-autoconfigure</artifactId>
            <version>2.2.13.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-openid</artifactId>
        </dependency>

网络安全文件

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    private JdbcOidcBearerTokenFilter filter;

    @Autowired
    public WebSecurityConfig(@Value("${security.oauth2.client.wellKnownUrl}") String wellKnown
            , @Value("${security.oauth2.client.clientId}") String clientId
            , @Value("${security.oauth2.client.clientSecret}") String clientSecret
            , EaUserService usersService, LoginService loginService) {

        OidcService oidcService = new OidcService(wellKnown, clientId, clientSecret);
        this.filter = new JdbcOidcBearerTokenFilter(oidcService, usersService, loginService, "Authorization");
    }

    @Override
    public void configure(WebSecurity webSecurity) {
        webSecurity
                .ignoring()
                .antMatchers("/error", "/403.html");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .addFilterAfter(new OAuth2ClientContextFilter(), AbstractPreAuthenticatedProcessingFilter.class)
                .addFilterAfter(this.filter, OAuth2ClientContextFilter.class)
                .authorizeRequests()
                .antMatchers("/api/login/**", "/static/**").permitAll()   
                .antMatchers("/api/enforcementactions/**").hasAnyRole("ADMIN","DEVELOPER","USER")
    }
}

控制器与预授权标签在这里我忘了添加'用户'的标签，在第一次被拒绝访问，但不应该在httpsecurity方法中的上述设置已经照顾它？

@PreAuthorize("hasAnyRole('ADMIN','DEVELOPER','USER')")
@RestController
@RequestMapping("/api/enforcementactions")
public class EnforcementActionsController {

    @Autowired
    private EnforcementActionsService service;

    @GetMapping("/getallactions")
    public ResponseEntity<?> getAllEnforcementActions() {
        ... do stuff here and return data
    }