@PermitAll and @Secured(SecurityRule.IS_ANONYMOUS) not working on methods with any sort of parameter (body, header or query)

[nbrugger-tgm]

Expected Behavior

When adding @Secured(SecurityRule.IS_ANONYMOUS) and/or @PermitAll to a HTTP handler method (@Post ....) it should allow unchecked and anonymous access to said method, even when passing parameters such as a body!

Actual Behaviour

Requests to endpoints with query parameters, headers or Body are turned down as HttpClientResponseException: Unauthorized (or whichever http client you use)

I have a MVCE; https://github.com/nbrugger-tgm/micronaut-reproductions/tree/main/permit-all-body-issue

Steps To Reproduce

1. clone https://github.com/nbrugger-tgm/micronaut-reproductions to your local machine
2. cd micronaut-reproductions/permit-all-body-issue
3. ./gradle test

Environment Information

• Operating System: Linux
• Micronaut Version: 4.x (tested like 12 versions including latest)

Example Application

https://github.com/nbrugger-tgm/micronaut-reproductions/tree/main/permit-all-body-issue

Version

4.x.x