Spring Security: user with role is not able to access to endpoint - spring

Question

I've created this straightforward controller:
#RestController
#RequestMapping("/orders")
public class OrderController {
#GetMapping("/list")
#PreAuthorize(value = "hasRole('VIEWER')")
public List<String> list() {
return new ArrayList<String>();
}
}
As you can see, it's protected by #PreAuthorize(value = "hasRole('VIEWER')").
According to logs:
Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#99305100: Principal: username; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: VIEWER
Voter: org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter#4799314a, returned: -1
Voter: org.springframework.security.access.vote.RoleVoter#41e7ad2c, returned: 0
Voter: org.springframework.security.access.vote.AuthenticatedVoter#79a89d7d, returned: 0
Access is denied (user is not anonymous); delegating to AccessDeniedHandler
org.springframework.security.access.AccessDeniedException: Access is denied
As you can see, user is authenticated and has role VIEWER. However, it's NOT able to reach _/orders/list endpoint since "access is denied".
Previous log snippet:
Principal: username; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: VIEWER
My JWTFilter looks like:
package com.tsystems.covid.marketplace.backend.config.security;
import java.io.IOException;
import java.util.Arrays;
import java.util.List;
import java.util.Optional;
import java.util.stream.Collectors;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.filter.OncePerRequestFilter;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
public class JWTAuthorizationFilter extends OncePerRequestFilter {
private static final Logger LOG = LoggerFactory.getLogger(JWTAuthorizationFilter.class);
private TokenProperties tokenProperties;
public JWTAuthorizationFilter(
TokenProperties tokenProperties
) {
this.tokenProperties = tokenProperties;
}
#Override
protected void doFilterInternal(
HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain
) throws ServletException, IOException {
Claims claims = this.getAuthorizationToken(request)
.map(this::validateToken)
.orElse(null);
if (null != claims) {
this.setUpAuthentication(claims);
}
filterChain.doFilter(request, response);
}
/**
*
* #param request
* #return
*/
private Optional<String> getAuthorizationToken(HttpServletRequest request) {
return Optional
.ofNullable(request.getHeader(SecurityConstants.AUTHORIZATION_HEADER))
.filter(header -> header.startsWith(SecurityConstants.TOKEN_PREFIX))
.map(header -> header.replace(SecurityConstants.TOKEN_PREFIX, ""));
}
/**
*
* #param token
* #return
*/
private Claims validateToken(String token) {
return Jwts.parser()
.setSigningKey(this.tokenProperties.getSecret())
.parseClaimsJws(token)
.getBody();
}
/**
*
* #param claims
*/
private void setUpAuthentication(Claims claims) {
UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(
claims.getSubject(),
null,
this.parseAuthorities((List<String>)claims.get(SecurityConstants.JWT_AUTHORITIES_CLAIM))
);
SecurityContextHolder.getContext().setAuthentication(auth);
}
/**
*
* #param authorities
* #return
*/
private List<GrantedAuthority> parseAuthorities(List<String> authorities) {
return authorities
.stream()
.map(SimpleGrantedAuthority::new)
.collect(Collectors.toList());
}
}
Any ideas?

Answer 1

I think it's because the default prefix of spring
try to make this
#RestController
#RequestMapping("/orders")
public class OrderController {
#GetMapping("/list")
#PreAuthorize(value = "hasRole('ROLE_VIEWER')")
public List<String> list() {
return new ArrayList<String>();
}
}
because spring add ROLE_ before the role by default

Answer 2

You give Granted Authorities: VIEWER then u need to use hasAuthority.
#PreAuthorize(value = "hasAuthority('VIEWER')")
If you want to use hasRole then pass Granted Authorities: ROLE_VIEWER then u can use this:
#PreAuthorize(value = "hasRole('VIEWER')")