title: Spring security 403 forbidden error keeps happening even with csrf disable
body: <p>I've been following a tutorial from <a href="https://programmingtechie.com/2019/11/08/build-a-full-stack-reddit-clone-with-spring-boot-and-angular-part-3/" rel="nofollow noreferrer">https://programmingtechie.com/2019/11/08/build-a-full-stack-reddit-clone-with-spring-boot-and-angular-part-3/</a>.</p>
  
  <p>And for some reason, <code>/auth/api/login</code> REST-API keeps throwing 403 forbidden error (Access denied) even when I disabled csrf.</p>
  
  <pre class="lang-java prettyprint-override"><code>    @Override
      public void configure(HttpSecurity httpSecurity) throws Exception {
          httpSecurity.cors().and()
                  .csrf().disable()
                  .authorizeRequests()
                  .antMatchers("/api/auth/**")
                  .permitAll()
                  .anyRequest()
                  .authenticated();
  
          httpSecurity.addFilterBefore(jwtAuthenticationFilter,
                  UsernamePasswordAuthenticationFilter.class);
      }
  </code></pre>
  
  <p>This is on the <code>SecurityConfig</code> class extending <code>WebSecurityConfigurerAdapter</code>.</p>
  
  <p>Below is the <code>AuthController</code>.</p>
  
  <pre class="lang-java prettyprint-override"><code>@RestController
  @RequestMapping("/api/auth")
  @AllArgsConstructor
  public class AuthController {
  
      private final AuthService authService;
      private final RefreshTokenService refreshTokenService;
  
      @PostMapping("/signup")
      public ResponseEntity&lt;String&gt; signup (@RequestBody RegisterRequest registerRequest) {
          authService.signup(registerRequest);
          return new ResponseEntity&lt;&gt;("User Registration Successful", HttpStatus.OK);
      }
  
      @PostMapping("/login")
      public AuthenticationResponse login(@RequestBody LoginRequest loginRequest) {
          return authService.login(loginRequest);
      }
  
      @GetMapping("accountVerification/{token}")
      public ResponseEntity&lt;String&gt; verifyAccount(@PathVariable String token) {
          authService.verifyAccount(token);
          return new ResponseEntity&lt;&gt;("Account Activated Successfully", OK);
      }
  </code></pre>
  
  <p>When I try requesting <code>http://localhost:8080/api/auth/signup</code>, it works just fine but  <code>http://localhost:8080/api/auth/login</code> keeps returning 403 forbidden error.</p>
  
  <p>To be clear, below is the <code>JwtAuthenticationFilter</code> class.</p>
  
  <pre class="lang-java prettyprint-override"><code>    @Override
      protected void doFilterInternal(HttpServletRequest request,
                                      HttpServletResponse response,
                                      FilterChain filterChain) throws ServletException, IOException {
          String jwt = getJwtFromRequest(request);
  
          if (StringUtils.hasText(jwt) &amp;&amp; jwtProvider.validateToken(jwt)){
              String username = jwtProvider.getUsernameFromJwt(jwt);
  
              UserDetails userDetails = userDetailsService.loadUserByUsername(username);
              UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails,
                      null, userDetails.getAuthorities());
  
              authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
  
              SecurityContextHolder.getContext().setAuthentication(authentication);
          }
  
          filterChain.doFilter(request, response);
      }
  
      private String getJwtFromRequest(HttpServletRequest request){
          String bearerToken = request.getHeader("Authorization");
  
          if(StringUtils.hasText(bearerToken) &amp;&amp; bearerToken.startsWith("Bearer ")){
              return bearerToken.substring(7);
          }
  
          return bearerToken;
      }
  </code></pre>
  
  <p>Can somebody point out the mistakes or is there more configuration that I need to do?</p>