title: Spring WebMvcTest with post returns 403
body: <p>I'm wondering where the issue is with my code, every time I run a post test (irrespective of what controller it targets, or method), I return a 403 error, when in some cases I expect a 401, and in others a 200 response (with auth).</p>
  
  <p>This is a snippet from my controller:</p>
  
  <pre><code>@RestController
  @CrossOrigin("*")
  @RequestMapping("/user")
  class UserController @Autowired constructor(val userRepository: UserRepository) {
      @PostMapping("/create")
      fun addUser(@RequestBody user: User): ResponseEntity&lt;User&gt; {
          return ResponseEntity.ok(userRepository.save(user))
      }
  }
  </code></pre>
  
  <p>And my unit test targeting this controller</p>
  
  <pre><code>@RunWith(SpringRunner::class)
  @WebMvcTest(UserController::class)
  class UserControllerTests {
      @Autowired
      val mvc: MockMvc? = null
  
      @MockBean
      val repository: UserRepository? = null
  
      val userCollection = mutableListOf&lt;BioRiskUser&gt;()
  
      @Test
      fun testAddUserNoAuth() {
          val user = BioRiskUser(
                  0L,
                  "user",
                  "password",
                  mutableListOf(Role(
                      0L,
                      "administrator"
                  )))
          repository!!
          `when`(repository.save(user)).thenReturn(createUser(user))
          mvc!!
          mvc.perform(post("/create"))
                  .andExpect(status().isUnauthorized)
      }
  
      private fun createUser(user: BioRiskUser): BioRiskUser? {
          user.id=userCollection.count().toLong()
          userCollection.add(user)
          return user
      }
  }
  </code></pre>
  
  <p>What am I missing?</p>
  
  <p>As requested, my security config...</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  class SecurityConfig(private val userRepository: UserRepository, private val userDetailsService: UserDetailsService) : WebSecurityConfigurerAdapter() {
      @Bean
      override fun authenticationManagerBean(): AuthenticationManager {
          return super.authenticationManagerBean()
      }
  
      override fun configure(auth: AuthenticationManagerBuilder) {
          auth.authenticationProvider(authProvider())
      }
  
      override fun configure(http: HttpSecurity) {
          http
              .csrf().disable()
              .cors()
              .and()
              .httpBasic()
              .realmName("App Realm")
              .and()
              .authorizeRequests()
              .antMatchers("/img/*", "/error", "/favicon.ico", "/doc")
              .anonymous()
              .anyRequest().authenticated()
              .and()
              .logout()
              .invalidateHttpSession(true)
              .clearAuthentication(true)
              .logoutSuccessUrl("/user")
              .permitAll()
      }
  
      @Bean
      fun authProvider(): DaoAuthenticationProvider {
          val authProvider = CustomAuthProvider(userRepository)
          authProvider.setUserDetailsService(userDetailsService)
          authProvider.setPasswordEncoder(encoder())
          return authProvider
      }
  }
  </code></pre>
  
  <p>and the auth provider</p>
  
  <pre><code>class CustomAuthProvider constructor(val userRepository: UserRepository) : DaoAuthenticationProvider() {
      override fun authenticate(authentication: Authentication?): Authentication {
          authentication!!
          val user = userRepository.findByUsername(authentication.name)
          if (!user.isPresent) {
              throw BadCredentialsException("Invalid username or password")
          }
          val result = super.authenticate(authentication)
          return UsernamePasswordAuthenticationToken(user, result.credentials, result.authorities)
      }
  
  
      override fun supports(authentication: Class&lt;*&gt;?): Boolean {
          return authentication?.equals(UsernamePasswordAuthenticationToken::class.java) ?: false
      }
  }
  </code></pre>