Answer the question
In order to leave comments, you need to log in
Why is the request filter not working in Spring Security?
ADMINISTRATOR
Why do I get 403 Forbidden
when a user with permissions tries to make any request , even though it says that the administrator can make any requests ( .anyRequest().hasRole(ADMINISTRATOR.name())
)?
There is a query filter like this:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers(HttpMethod.GET, GIFT_CERTIFICATES + "/**").permitAll() // GUEST - Read operations for main entity
.antMatchers(AUTHENTICATION + "/**").permitAll() // For GUESTs
.antMatchers(AUTHENTICATION + "/**").anonymous() // Access to authorized users is not allowed.
.antMatchers(HttpMethod.POST, ORDERS).hasRole(USER.name()) // USER - Make an order on main entity
.antMatchers(HttpMethod.GET).hasRole(USER.name()) // USER - All read operations
.anyRequest().hasRole(ADMINISTRATOR.name()) // ADMINISTRATOR - All operations, including addition and modification of entities
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
Answer the question
In order to leave comments, you need to log in
Good afternoon.
What does it return ADMINISTRATOR.name()
?
Don't forget the prefix: ROLE_
in the role name.
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question