Access denied 403 in request as an admin [closed] - spring-boot

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 16 hours ago.
Improve this question
I try GET requests as an admin and I take 403 forbidden.
I have the class user. The user can be admin or simple user. I implement JWT security. I can register and authenticate as a simple user and ran different requests. As an admin I don't want to register just authenticate. So in my AuthenticationService I give to the admin a standard email and password.
The AuthenticationService class:
#Service
#RequiredArgsConstructor
public class AuthenticationService {
private final UserRepository repository;
private final PasswordEncoder passwordEncoder;
private final JwtService jwtService;
private final AuthenticationManager authenticationManager;
private final String ADMIN_EMAIL = "admin#example.com";
private final String ADMIN_PASSWORD = "admin123";
public AuthenticationResponse register(RegisterRequest request) {
var user = User.builder()
.firstName(request.getFirstName())
.vatNumber(request.getVatNumber())
.lastname(request.getLastname())
.email(request.getEmail())
.password(passwordEncoder.encode(request.getPassword()))
.role(Role.USER)
.build();
repository.save(user);
var jwtToken = jwtService.generateToken(user);
return AuthenticationResponse.builder()
.token(jwtToken)
.build();
}
public AuthenticationResponse authenticate(AuthenticationRequest request) {
// Check if the request is for the admin user
if (request.getEmail().equals(ADMIN_EMAIL) && request.getPassword().equals(ADMIN_PASSWORD)) {
var user = User.builder()
.email(ADMIN_EMAIL)
.password(passwordEncoder.encode(ADMIN_PASSWORD))
.role(Role.ADMIN)
.build();
var jwtToken = jwtService.generateToken(user);
return AuthenticationResponse.builder()
.token(jwtToken)
.build();
}
authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(
request.getEmail(),
request.getPassword()
)
);
var user = repository.findByEmail(request.getEmail())
.orElseThrow(() -> new UnauthorizedException("Invalid credentials"));
var jwtToken = jwtService.generateToken(user);
return AuthenticationResponse.builder()
.token(jwtToken)
.build();
}
}
The controller:
#RestController
#RequestMapping("/api/v1/auth")
#RequiredArgsConstructor
public class AuthenticationController {
private final AuthenticationService service;
#PostMapping("/register")
public ResponseEntity<AuthenticationResponse> register(
#RequestBody RegisterRequest request) {
return ResponseEntity.ok(service.register(request));
}
#PostMapping("/authenticate")
public ResponseEntity<AuthenticationResponse> authenticate(
#RequestBody AuthenticationRequest request) {
try {
return ResponseEntity.ok(service.authenticate(request));
} catch (UnauthorizedException e) {
return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
} catch (ForbiddenException e) {
return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
}
}
#PostMapping("/authenticate/admin")
public ResponseEntity<AuthenticationResponse> authenticateAdmin() {
try {
AuthenticationRequest adminRequest = new AuthenticationRequest();
adminRequest.setEmail("admin#example.com");
adminRequest.setPassword("admin123");
return ResponseEntity.ok(service.authenticate(adminRequest));
} catch (UnauthorizedException e) {
return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
} catch (ForbiddenException e) {
return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
}
}
}
The JwtAuthenticationFilter:
#Component
#RequiredArgsConstructor
public class JwtAuthenticationFilter extends OncePerRequestFilter {
private final JwtService jwtService;
private final UserDetailsService userDetailsService;
#Override
protected void doFilterInternal(
#NonNull HttpServletRequest request,
#NonNull HttpServletResponse response,
#NonNull FilterChain filterChain) throws ServletException, IOException {
final String authHeader = request.getHeader("Authorization");
final String jwt;
final String userEmail;
if (authHeader == null ||!authHeader.startsWith("Bearer ")) {
filterChain.doFilter(request, response);
return;
}
jwt = authHeader.substring(7);
userEmail = jwtService.extractUsername(jwt);
if (userEmail != null && SecurityContextHolder.getContext().getAuthentication() == null) {
UserDetails userDetails = this.userDetailsService.loadUserByUsername(userEmail);
if (jwtService.isTokenValid(jwt, userDetails)) {
UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
userDetails,
null,
userDetails.getAuthorities()
);
authToken.setDetails(
new WebAuthenticationDetailsSource().buildDetails(request)
);
SecurityContextHolder.getContext().setAuthentication(authToken);
}
}
filterChain.doFilter(request, response);
}
}
I ran the project and try POST request at localhost:8080/api/v1/auth/authenticate/admin with:
{
"email": "admin#example.com",
"password": "admin123"
}
#EnableWebSecurity
#RequiredArgsConstructor
public class SecurityConfiguration {
private final JwtAuthenticationFilter jwtAuthFilter;
private final AuthenticationProvider authenticationProvider;
#Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.headers()
.frameOptions().disable()
.and()
.csrf().disable()
.authorizeHttpRequests()
.requestMatchers("/h2/**").permitAll()
.requestMatchers("/api/v1/auth/**").permitAll()
.anyRequest().authenticated()
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authenticationProvider(authenticationProvider)
.addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
return http.build();
}
}
I take the bearer token. And then when I try GET request at localhost:8080/users/all with the bearer token which I received I take 403 forbidden. But if I register as a simple user and then authenticate I have access at GET request at localhost:8080/users/all.
What is the problem?