title: role based authorization using spring security
body: <p>I am using spring boot application with spring security using jwt.</p>
  
  <p>login user is having the admin access, and he is trying to delete the user, it is accepting with the following code</p>
  
  <p><strong>angular:-</strong></p>
  
  <pre><code>    delete(userId: number) {
          debugger;
          return this.http.delete(`/api/v1/admin/deleteUser/${userId}`);
      }
  </code></pre>
  
  <p><strong>SpringSecurityConfig.java</strong></p>
  
  <pre><code>@Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable()      
           .headers()
            .frameOptions().sameOrigin()
            .and()
              .authorizeRequests()
               .antMatchers("/api/v1/authenticate", "/api/v1/register","/api/v1/basicauth").permitAll()
                  .antMatchers("/").permitAll()
                  .antMatchers("/admin/**").hasRole("ADMIN")//only admin can access this
                  .anyRequest().authenticated()
                  .and()
              .formLogin()
                  .loginPage("/login")
                  .defaultSuccessUrl("/home")
                  .failureUrl("/login?error")
                  .permitAll()
                  .and()
              .logout()
               .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
               .logoutSuccessUrl("/login?logout")
               .deleteCookies("my-remember-me-cookie")
                  .permitAll()
                  .and()
              .exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).and().sessionManagement()
              .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  
              // Add a filter to validate the tokens with every request
              http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
      }
  </code></pre>
  
  <p><strong>controller.java</strong></p>
  
  <pre><code>@DeleteMapping(path = "/admin/deleteUser/{userId}")
      public ResponseEntity&lt;?&gt; deleteUser(HttpServletRequest request,@PathVariable int userId) { 
  
          authenticationService.deleteUser(userId);
  
          return ResponseEntity.ok((""));
      }
  </code></pre>
  
  <p>but in my application user login with <code>ROLE_USER</code>, he is also able to access that method, how to restrict access upto <code>ROLE_ADMIN</code> only.</p>