Apply HttpSecurity for GET request - spring

Question

I have this rest endpoint:
#RestController
#RequestMapping("/data")
public class DataPagesController {
#GetMapping("/page")
public ResponseEntity<?> page() {
List<String> list = new ArrayList<>();
list.add("test 1");
list.add("test 2");
list.add("test 3");
list.add("test 4");
return new ResponseEntity<>(list, HttpStatus.OK);
}
}
I have configured context path prefix into the project using:
server:
port: 8080
servlet:
context-path: /engine
I want to restrict the access using:
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.httpBasic()
// Allow GET for dashboard page
.authorizeRequests().antMatchers(HttpMethod.GET, "/data/page").authenticated()
// Allow all requests by logged in users
.anyRequest().authenticated()
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
But I get error:
GET http://localhost:8080/engine/data/page 401
Do you know what is the proper way to configure endpoint permissions for GET request?
One possible idea:
Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
19:12:37.834 [http-nio-8080-exec-8] DEBUG AffirmativeBased[decide:66] - Voter: org.springframework.security.web.access.expression.WebExpressionVoter#659a59ae, returned: -1
19:12:37.834 [http-nio-8080-exec-8] DEBUG ExceptionTranslationFilter[handleSpringSecurityException:180] - Access is denied (user is anonymous); redirecting to authentication entry point
I need to remove maybe .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

Answer 1

401 means that you are not authorized, so it means you are not passing the token you have configured, or your are not passing as spring it is expecting, or the token you are passing is wrong / expired
Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided. The response must include a WWW-Authenticate header field containing a challenge applicable to the requested resource. See Basic access authentication and Digest access authentication.[32] 401 semantically means "unauthorised",[33] the user does not have valid authentication credentials for the target resource.
401 error code from wikipedia