title: HTTP 403 forbidden error in spring boot security
body: <p>Spring security configuration class</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter{
  
      @Autowired
      private UserDetailsService userDetailsService;
  
      @Bean
      public PasswordEncoder getPasswordEncoder() {
          return new BCryptPasswordEncoder();
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http
              .cors()
              .and()
              .authorizeRequests()
              .antMatchers("/user", "/login").permitAll()
              .antMatchers("/employee", "/insurance").hasRole("User")
              .anyRequest()
              .authenticated()
              .and()
              .httpBasic()
              .and()
              .csrf().disable();
      }
  
      protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userDetailsService).passwordEncoder(getPasswordEncoder());
      }
  }
  </code></pre>
  
  <p>UserDetailsService Implementation class</p>
  
  <pre><code>@Service
  public class UserDetailsServiceImpl implements UserDetailsService {
  
      @Autowired
      private UserService userService;
  
      @Override
      public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
          User user = null;
          Set&lt;GrantedAuthority&gt; grantedAuthorities = null;
          try
          {
              user = userService.findByUserName(userName);
              if(user == null)
                  throw new UsernameNotFoundException("User " + userName  + " not available");
  
              grantedAuthorities = new HashSet&lt;&gt;();
              for(Role role: user.getRoles()) {
                  grantedAuthorities.add(new SimpleGrantedAuthority(role.getRole().toString()));
              }
          }
          catch(Exception exp) {
              exp.printStackTrace();
          }
          return new org.springframework.security.core.userdetails.User(user.getUserName(), user.getPassword(), grantedAuthorities);
      }
  }
  </code></pre>
  
  <p>Employee Rest Controller class</p>
  
  <pre><code>@RestController
  public class EmployeeController {
  
      @Autowired
      private EmployeeService employeeService;
  
      @Autowired
      private InsuranceService insuranceService;
  
      @PostMapping("/employee")
      public ResponseEntity&lt;Employee&gt; create(@RequestBody Employee employee) throws Exception {
          employee = employeeService.create(employee);
          return new ResponseEntity&lt;Employee&gt;(employee, HttpStatus.CREATED);
      }
  
      @PutMapping("/employee")
      public ResponseEntity&lt;Employee&gt; update(@RequestBody Employee employee) throws Exception {
          employee = employeeService.update(employee);
          return new ResponseEntity&lt;Employee&gt;(employee, HttpStatus.OK);
      }
  
      @DeleteMapping("/employee/{id}")
      public ResponseEntity&lt;String&gt; delete(@PathVariable("id") long id) throws Exception {
          employeeService.delete(id);
          return new ResponseEntity&lt;String&gt;("Employee deleted successfully", HttpStatus.OK);
      }
  
      @GetMapping("/employee/{id}")
      public ResponseEntity&lt;Employee&gt; findEmployeeDetails(@PathVariable("id") long id) throws Exception {
          Employee employee = employeeService.findById(id);
          return new ResponseEntity&lt;Employee&gt;(employee, HttpStatus.OK);
      }
  
      @GetMapping("/employee")
      public ResponseEntity&lt;List&lt;Employee&gt;&gt; findAll() throws Exception {
          List&lt;Employee&gt; employees = employeeService.findAll();
          return new ResponseEntity&lt;List&lt;Employee&gt;&gt;(employees, HttpStatus.OK);
      }
  }
  </code></pre>
  
  <p>I am getting 403 forbidden error for any of the HTTP method(POST/GET/PUT) request submitted via postman to <strong>/employee</strong> URL</p>
  
  <pre><code>{
      "timestamp": "2019-09-17T05:37:35.778+0000",
      "status": 403,
      "error": "Forbidden",
      "message": "Forbidden",
      "path": "/hr-core/employee"
  }
  </code></pre>
  
  <p>I am getting this error even though I am sending correct username &amp; password in the basic auth header(Authorization) of HTTP request in POSTMAN. This user is also having both USER and ADMIN roles to access <strong>/employee</strong> REST endpoint. I have disabled <strong>CSRF</strong> in http security.</p>
  
  <p>How can I solve this error?</p>