title: Testing Spring Controller POST method after adding Spring Security on Kotlin
body: <p>I'm developing a Spring Boot application with Kotlin.
  I recently added Spring Security as a dependency and now I'm not able to test my Controllers anymore.</p>
  
  <p>This is my controller:</p>
  
  <pre><code>@RestController
  @RequestMapping("/users", produces = [MediaType.APPLICATION_JSON_UTF8_VALUE])
  class UserController {
      @Autowired
      lateinit var userService: UserService
  
      @PostMapping
      fun addUser(@Valid @RequestBody user: User): ResponseEntity&lt;PostUserResponse&gt; {
          userService.addUser(user)
          return ResponseEntity.status(HttpStatus.CREATED).body(PostUserResponse())
      }
  
      @GetMapping("user/{login}")
      fun getUserByLogin(@PathVariable login: String): ResponseEntity&lt;User&gt; {
          val user = userService.getUserByLogin(login)
          return ResponseEntity.status(HttpStatus.OK).body(user)
      }
  
      @ExceptionHandler(NoSuchElementException::class)
      fun failedToRetrieveById(exception: NoSuchElementException): ResponseEntity&lt;UserNotFoundResponse&gt; {
          return ResponseEntity.status(HttpStatus.NOT_FOUND).body(UserNotFoundResponse())
      }
  }
  </code></pre>
  
  <p>And this is my test class:</p>
  
  <pre><code>@ExtendWith(SpringExtension::class)
  @WebMvcTest(controllers = [UserController::class])
  @TestInstance(TestInstance.Lifecycle.PER_CLASS)
  class UserControllerTest {
      @MockBean
      private lateinit var userService: UserService
  
      @Autowired
      private lateinit var context: WebApplicationContext
  
      private lateinit var mvc : MockMvc
  
      val login = "test@test.test"
      val password = "password"
      val user = User(login = login, password = password)
  
      @BeforeAll
      fun setup () {
          mvc = MockMvcBuilders
                  .webAppContextSetup(context)
                  .apply&lt;DefaultMockMvcBuilder&gt;(springSecurity())
                  .build()
      }
  
      @Test
      fun `Sending POST to the users endpoint with a valid json creates a new user`() {
          val payload = mapOf(
                  "login" to login,
                  "password" to password
          )
          Mockito.`when`(userService.addUser(user))
                  .thenReturn(user)
  
  
          mvc.perform(MockMvcRequestBuilders.post("/users")
                  .with(csrf().asHeader())
                  .contentType(MediaType.APPLICATION_JSON_UTF8)
                  .content(JSONObject(payload).toString()))
                  .andExpect(MockMvcResultMatchers.status().isCreated)
                  .andExpect(MockMvcResultMatchers.content().contentType(MediaType.APPLICATION_JSON_UTF8))
      }
  }
  </code></pre>
  
  <p>My code mimics the example that can be found here:
  <a href="https://docs.spring.io/spring-security/site/docs/4.0.x/reference/htmlsingle/#test-mockmvc-smmrpp" rel="nofollow noreferrer">https://docs.spring.io/spring-security/site/docs/4.0.x/reference/htmlsingle/#test-mockmvc-smmrpp</a></p>
  
  <p>But still the HTTP code of the reply is 401.</p>
  
  <p>It's interesting to notice that removing the line:</p>
  
  <pre><code>.with(csrf().asHeader())
  </code></pre>
  
  <p>Makes the server reply with a 403 instead of a 401.</p>
  
  <p>My security configuration is basically "blank". I'm not specifying any restrictions so, according to the documentation the only problem should be providing a valid CSRF token.</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  class WebSecurityConfig : WebSecurityConfigurerAdapter() {
      override fun configure (httpSecurity: HttpSecurity) {
          httpSecurity
                  .authorizeRequests()
                  .antMatchers("/*")
                  .permitAll()
      }
  }
  </code></pre>
  
  <p>How to generate a valid request?</p>