title: Spring Security: Getting error "The server understood the request but refuses to authorize it"
body: <p>While running the application using Spring Security, I am getting below error on all browsers:</p>
  
  <blockquote>
    <p>"The server understood the request but refuses to authorize it"</p>
  </blockquote>
  
  <p>I tried by changing Roles from "ROLE_ADMIN" to "ROLE_USER" in "spring-security.xml" file.</p>
  
  <p>Below is "spring-security.xml"</p>
  
  <pre><code>&lt;http auto-config="true"&gt;
      &lt;intercept-url pattern ="/admin" access = "hasRole('ROLE-USER')"/&gt;
      &lt;/http&gt;
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name = "abc" password = "xyz" authorities="hasRole('ROLE-USER')" /&gt;
          &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>Below is SpringController Class:</p>
  
  <pre><code>@Controller
  public class SpringController {
  
  
  
  @RequestMapping(value = "/")
      public String homePage() {
          return "HomePage";
      }
      @RequestMapping(value="/admin", method=RequestMethod.GET)
      public String loginPage() {
          return "login";
  }
  </code></pre>
  
  <p>HomePage.jsp and login.jsp pages are loaded property but after passing credentials on login.jsp getting error:</p>
  
  <blockquote>
    <p>HTTP Status 403 – Forbidden</p>
    
    <hr>
    
    <p>Type: Status Report</p>
    
    <p>Message: Access is denied</p>
    
    <p>Description: The server understood the request but refuses to
    authorize it.</p>
    
    <hr>
    
    <p>Apache Tomcat/7.0.90</p>
  </blockquote>