I am working on a Spring Boot 3.3 application and using Spring Security 6 to secure my endpoints. I have configured the security as follows:

Problem:

Despite configuring hasAnyAuthority for POST and PUT requests, the getAuthorizationDecision method gets executed every time I hit the POST or PUT endpoints. It seems like hasAnyAuthority is not being checked. Is this the correct syntax, or am I missing something?
testAppId and MMT_APP_ID are authorities I want to check for.

Any help or suggestions on how to resolve this issue would be greatly appreciated. Thank you!

Tried moving the anyRequest().access((authentication, context) -> getAuthorizationDecision(authentication.get(), context)) configuration to different positions in the chain to see if it affects the behavior.

Expected behavior:

The hasAnyAuthority checks should be performed for POST and PUT requests to /api/mmt, allowing only users with the specified authorities to access these endpoints.

Actual behavior:

The getAuthorizationDecision method is executed for every request, including POST and PUT, bypassing the hasAnyAuthority checks.

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http, Environment environment) throws Exception {
    if (isProduction(environment.getProfile())) {
        testAppId = "";
    }

    http.csrf(AbstractHttpConfigurer::disable)
        .authorizeHttpRequests(authRequests -> authRequests
            .requestMatchers(HttpMethod.POST, "/api/mmt").hasAnyAuthority(testAppId, MMT_APP_ID)
            .requestMatchers(HttpMethod.PUT, "/api/mmt").hasAnyAuthority(testAppId, MMT_APP_ID)
            .anyRequest().access((authentication, context) -> getAuthorizationDecision(authentication.get(), context))
        )
        .addFilterBefore(oauthAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

    return http.build();
}