title: Access Denied Error in Spring Secirity while upgrading from spring boot starter 1.3.5.RELEASE to 1.5.2RELEASE
body: <p>I'm using the following dependencies.</p>
  
  <pre><code>&lt;dependencies&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
          &lt;artifactId&gt;spring-cloud-starter-eureka-server&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;!-- zuul Spring Security dependencies --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
          &lt;artifactId&gt;spring-cloud-starter-zuul&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
          &lt;artifactId&gt;spring-cloud-config-server&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-test&lt;/artifactId&gt;
          &lt;scope&gt;test&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;!-- Bean Validation provider --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.hibernate&lt;/groupId&gt;
          &lt;artifactId&gt;hibernate-validator&lt;/artifactId&gt;
      &lt;/dependency&gt;
  
      &lt;!-- Spring Security dependencies --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;!-- OAuth --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security.oauth&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-oauth2&lt;/artifactId&gt;
          &lt;version&gt;2.1.0.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;!-- jwt signer --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-jwt&lt;/artifactId&gt;
      &lt;/dependency&gt;
  &lt;/dependencies&gt;
  
  &lt;dependencyManagement&gt;
      &lt;dependencies&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
              &lt;artifactId&gt;spring-cloud-starter-parent&lt;/artifactId&gt;
              &lt;version&gt;Camden.SR6&lt;/version&gt;
              &lt;type&gt;pom&lt;/type&gt;
              &lt;scope&gt;import&lt;/scope&gt;
          &lt;/dependency&gt;
      &lt;/dependencies&gt;
  &lt;/dependencyManagement&gt;
  &lt;parent&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
      &lt;version&gt;1.5.2.RELEASE&lt;/version&gt;
      &lt;relativePath /&gt; &lt;!-- lookup parent from repository --&gt;
  &lt;/parent&gt;
  </code></pre>
  
  <p>I had to upgrade my spring boot version in order to accomodate the version upgradation of spring-cloud-starter-parent to Camden.SR6.</p>
  
  <p>while upgrading, the rest end points <strong>/home/sample</strong> which was working perfectly began to break with 403-forbidden error.</p>
  
  <p>Security Configuration file: </p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private ClientDetailsService clientDetailsService;
  
      @Autowired
      private UserDetailsServiceImpl userDetailsService;
  
      @Autowired
      public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userDetailsService).passwordEncoder(getPasswordEncoder());
      }
  
      private Md5PasswordEncoder getPasswordEncoder() {
          return new Md5PasswordEncoder();
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable().anonymous().disable().authorizeRequests().requestMatchers(CorsUtils::isPreFlightRequest)
                  .permitAll().antMatchers("/home/sample").authenticated().antMatchers("/home/**").authenticated();
      }
  
      @Override
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Bean
      public TokenStore tokenStore() {
          return new InMemoryTokenStore();
      }
  
      @Bean
      public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore) {
          TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
          handler.setTokenStore(tokenStore);
          handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
          handler.setClientDetailsService(clientDetailsService);
          return handler;
      }
  
      @Bean
      public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
          TokenApprovalStore store = new TokenApprovalStore();
          store.setTokenStore(tokenStore);
          return store;
      }
  }
  </code></pre>