401 Unauthorized error: Bad credentials when using @PreAuthorize

Question

I'm allways having an error when testing service in postman for example if i test ModeratorAccess() it always generate 401 Bad Credentials. i think the problem in the configuration but i hope the jwt token part is good.

enter image description here

this is my configuration file :

@Configuration
@EnableAspectJAutoProxy

@EnableWebSecurity
@EnableGlobalMethodSecurity(
        securedEnabled = true,
        // jsr250Enabled = true,
        prePostEnabled = true,
        proxyTargetClass = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    UserDetailsServiceImpl userDetailsService;

    @Autowired
    private AuthEntryPointJwt unauthorizedHandler;

    @Bean
    public AuthTokenFilter authenticationJwtTokenFilter() {
        return new AuthTokenFilter();
    }

    @Override
    public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable()
            .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
            .authorizeRequests().antMatchers("/api/auth/**").permitAll()
            .antMatchers("/api/test/**").permitAll()
            .anyRequest().authenticated();

        http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}

and this is my controller:

@CrossOrigin(origins = "*", maxAge = 3600)
@RestController
@RequestMapping("/api/test")
public class TestController {
    @GetMapping("/all")
    public String allAccess() {
        return "Public Content.";
    }
    
    @GetMapping("/user")
    @PreAuthorize("hasRole('USER') or hasRole('MODERATOR') or hasRole('ADMIN')")
    public String userAccess() {
        return "User Content.";
    }

    @GetMapping("/mod")
    @PreAuthorize("hasRole('MODERATOR')")
    //@PreAuthorize("permitAll")
    public String moderatorAccess() {
        return "Moderator Board.";
    }

    @GetMapping("/admin")
    @PreAuthorize("hasRole('ADMIN')")
    public String adminAccess() {
        return "Admin Board.";
    }
}

I'm new to spring security.

Answer 1

there are a few points to be checked for 401 error

1. Try removing @preAuthorise from your method moderatorAccess() as you have already said that here

   .antMatchers("/api/test/**").permitAll() .anyRequest().authenticated();

2. check the token passed in your header and your jwtfilter class, if you are following any tutorial, usually we make wrong key , so the token in header should be like key: Authorization and value as Bearer 'your toke here' , plaster your filter code here for reference

3.You can remove the annotation @preauthorise and try this

antMatchers("/api/auth/seller/**").hasAuthority("ADMIN").

4. Also when granting roles to the users, people make a mistake in role and Authority

   a role is just an authority with a special ROLE_ prefix. So in Spring security 3 @PreAuthorize("hasRole('ROLE_XYZ')") is the same as @PreAuthorize("hasAuthority('ROLE_XYZ')") and in Spring security 4 @PreAuthorize("hasRole('XYZ')") is the same as @PreAuthorize("hasAuthority('ROLE_XYZ')").

Read more here - Difference between Role and GrantedAuthority in Spring Security

5. check the token generated is for the correct role, like in your database the user is the moderator role and you are creating jwt token with that user and hitting an API with admin access

6. Check if there is an error in configuring by disabling spring security and check if the endpoint is working by removing the spring security

7. you can also enable formLogin in the same method of WebSecurityConfigurerAdapter like .formLogin() and try to hit the API with your browser using standard login page provided by spring security

8. Compare your code with this github repo having basic implementation of what you are trying to do https://github.com/koushikkothagal/spring-security-jwt