permission is ok

springboot-springSecurity2/src/main/java/com/us/example/config/WebSecurityConfig.java

@@ -22,7 +22,7 @@ import org.springframework.web.servlet.config.annotation.EnableWebMvc;
  */
 @Configuration
 @EnableWebSecurity
-//@EnableGlobalMethodSecurity(securedEnabled = true)
+@EnableGlobalMethodSecurity(securedEnabled = true)
 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
     @Autowired

springboot-springSecurity2/src/main/java/com/us/example/controller/HomeController.java

@@ -19,7 +19,7 @@ public class HomeController {
         return "getUsers";
     }
 
-    @Secured("ROLE_ADMIN")
+    @Secured({"ROLE_ADMIN","ROLE_USER"})
     @RequestMapping(method = RequestMethod.POST)
     @ResponseBody
     public String save() {