title: Spring cloud with spring security not working
body: <p><strong>GOAL</strong></p>
  <p>I want to use spring security with the cloud gateway to authenticate and authorize all the requests going to the microservices.</p>
  <p><strong>PROBLEM</strong></p>
  <p>The login post method for security works when this is just a <code>spring-boot-starter-web</code> microservice and other endpoints also work. But when I add the  <code>spring-cloud-starter-gateway</code> to the pom the authentication and authorization do not work.</p>
  <p><strong>POM file</strong></p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
  &lt;project xmlns=&quot;http://maven.apache.org/POM/4.0.0&quot; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot;
           xsi:schemaLocation=&quot;http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd&quot;&gt;
      &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
      &lt;parent&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
          &lt;version&gt;2.5.5&lt;/version&gt;
          &lt;relativePath/&gt; &lt;!-- lookup parent from repository --&gt;
      &lt;/parent&gt;
      &lt;groupId&gt;com.sagar&lt;/groupId&gt;
      &lt;artifactId&gt;apigateway&lt;/artifactId&gt;
      &lt;version&gt;0.0.1-SNAPSHOT&lt;/version&gt;
      &lt;name&gt;apigateway&lt;/name&gt;
      &lt;description&gt;apigateway&lt;/description&gt;
      &lt;properties&gt;
          &lt;java.version&gt;11&lt;/java.version&gt;
          &lt;kotlin.version&gt;1.5.31&lt;/kotlin.version&gt;
          &lt;spring-cloud.version&gt;2020.0.4&lt;/spring-cloud.version&gt;
      &lt;/properties&gt;
      &lt;dependencies&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-actuator&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.jetbrains.kotlin&lt;/groupId&gt;
              &lt;artifactId&gt;kotlin-reflect&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.jetbrains.kotlin&lt;/groupId&gt;
              &lt;artifactId&gt;kotlin-stdlib-jdk8&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
              &lt;artifactId&gt;spring-cloud-starter-config&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
              &lt;artifactId&gt;spring-cloud-starter-gateway&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
              &lt;artifactId&gt;spring-cloud-starter-netflix-eureka-client&lt;/artifactId&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-devtools&lt;/artifactId&gt;
              &lt;scope&gt;runtime&lt;/scope&gt;
              &lt;optional&gt;true&lt;/optional&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-test&lt;/artifactId&gt;
              &lt;scope&gt;test&lt;/scope&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;io.jsonwebtoken&lt;/groupId&gt;
              &lt;artifactId&gt;jjwt-api&lt;/artifactId&gt;
              &lt;version&gt;0.11.2&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;io.jsonwebtoken&lt;/groupId&gt;
              &lt;artifactId&gt;jjwt-impl&lt;/artifactId&gt;
              &lt;version&gt;0.11.2&lt;/version&gt;
              &lt;scope&gt;runtime&lt;/scope&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;io.jsonwebtoken&lt;/groupId&gt;
              &lt;artifactId&gt;jjwt-jackson&lt;/artifactId&gt;
              &lt;version&gt;0.11.2&lt;/version&gt;
              &lt;scope&gt;runtime&lt;/scope&gt;
          &lt;/dependency&gt;
          &lt;!--&lt;dependency&gt;
              &lt;groupId&gt;javax.servlet&lt;/groupId&gt;
              &lt;artifactId&gt;servlet-api&lt;/artifactId&gt;
              &lt;version&gt;2.3&lt;/version&gt;
          &lt;/dependency&gt;--&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
          &lt;/dependency&gt;
      &lt;/dependencies&gt;
      &lt;dependencyManagement&gt;
          &lt;dependencies&gt;
              &lt;dependency&gt;
                  &lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
                  &lt;artifactId&gt;spring-cloud-dependencies&lt;/artifactId&gt;
                  &lt;version&gt;${spring-cloud.version}&lt;/version&gt;
                  &lt;type&gt;pom&lt;/type&gt;
                  &lt;scope&gt;import&lt;/scope&gt;
              &lt;/dependency&gt;
          &lt;/dependencies&gt;
      &lt;/dependencyManagement&gt;
  
      &lt;build&gt;
          &lt;sourceDirectory&gt;${project.basedir}/src/main/kotlin&lt;/sourceDirectory&gt;
          &lt;testSourceDirectory&gt;${project.basedir}/src/test/kotlin&lt;/testSourceDirectory&gt;
          &lt;plugins&gt;
              &lt;plugin&gt;
                  &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
                  &lt;artifactId&gt;spring-boot-maven-plugin&lt;/artifactId&gt;
              &lt;/plugin&gt;
              &lt;plugin&gt;
                  &lt;groupId&gt;org.jetbrains.kotlin&lt;/groupId&gt;
                  &lt;artifactId&gt;kotlin-maven-plugin&lt;/artifactId&gt;
                  &lt;configuration&gt;
                      &lt;args&gt;
                          &lt;arg&gt;-Xjsr305=strict&lt;/arg&gt;
                      &lt;/args&gt;
                      &lt;compilerPlugins&gt;
                          &lt;plugin&gt;spring&lt;/plugin&gt;
                      &lt;/compilerPlugins&gt;
                  &lt;/configuration&gt;
                  &lt;dependencies&gt;
                      &lt;dependency&gt;
                          &lt;groupId&gt;org.jetbrains.kotlin&lt;/groupId&gt;
                          &lt;artifactId&gt;kotlin-maven-allopen&lt;/artifactId&gt;
                          &lt;version&gt;${kotlin.version}&lt;/version&gt;
                      &lt;/dependency&gt;
                  &lt;/dependencies&gt;
              &lt;/plugin&gt;
          &lt;/plugins&gt;
      &lt;/build&gt;
  
  &lt;/project&gt;
  </code></pre>
  <p><strong>AppSecurityConfig</strong></p>
  <pre><code>package com.sagar.apigateway.security
  
  import com.sagar.apigateway.Configs
  import org.springframework.beans.factory.annotation.Autowired
  import org.springframework.context.annotation.Bean
  import org.springframework.context.annotation.Configuration
  import org.springframework.http.HttpMethod
  import org.springframework.security.authentication.dao.DaoAuthenticationProvider
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
  import org.springframework.security.config.annotation.web.builders.HttpSecurity
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
  import org.springframework.security.config.http.SessionCreationPolicy
  import org.springframework.security.crypto.password.PasswordEncoder
  
  @Configuration
  @EnableWebSecurity
  class AppSecurityConfig : WebSecurityConfigurerAdapter() {
  
      @Autowired
      private lateinit var passwordEncoder: PasswordEncoder
  
      @Autowired
      private lateinit var appUserService: AppUserService
  
      @Autowired
      private lateinit var configs: Configs
  
      override fun configure(http: HttpSecurity?) {
          @Suppress(&quot;SimpleRedundantLet&quot;)
          http?.let {
              it
                  .csrf().disable()
                  .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                  .and()
                  .addFilter(JWTUsernameAndPasswordAuthenticationFilter(authenticationManager(), configs))
                  .addFilterAfter(JWTVerifier(configs), JWTUsernameAndPasswordAuthenticationFilter::class.java)
                  .authorizeRequests()
                  .antMatchers(HttpMethod.POST, &quot;/database&quot;).hasAuthority(AppUserPermission.ADMIN_WRITE.permission)
                  .antMatchers(HttpMethod.PUT, &quot;/database&quot;).hasAuthority(AppUserPermission.ADMIN_WRITE.permission)
                  .antMatchers(HttpMethod.DELETE, &quot;/database&quot;).hasAuthority(AppUserPermission.ADMIN_WRITE.permission)
                  .antMatchers(HttpMethod.GET, &quot;/database&quot;)
                  .hasAnyRole(AppUserRole.ADMIN.name, AppUserRole.ADMIN_TRAINEE.name)
                  .antMatchers(
                      &quot;/v2/api-docs&quot;,
                      &quot;/swagger-ui/index.html&quot;,
                      &quot;/swagger-ui/**&quot;,
                      &quot;/swagger-ui.html&quot;,
                      &quot;/swagger-resources/**&quot;,
                      &quot;/webjars/**&quot;,
                      &quot;/hello/sendEmail&quot;
                  ).permitAll()
                  .anyRequest().authenticated()
          }
      }
  
      override fun configure(auth: AuthenticationManagerBuilder) {
          auth.authenticationProvider(authProvider())
      }
  
      @Bean
      fun authProvider(): DaoAuthenticationProvider {
          val daoAuthProvider = DaoAuthenticationProvider()
          daoAuthProvider.setPasswordEncoder(passwordEncoder)
          daoAuthProvider.setUserDetailsService(appUserService)
          return daoAuthProvider
      }
  }
  </code></pre>