Why is my /books/book POST endpoint returning unauthorized - spring

Question

I am learning Spring Security and am trying to make a simple web service that holds the title of a book. I am trying to implement my security so that everyone can use GET on my /books/book endpoint and authorized users can POST to /books/book. For some reason my POST endpoint is saying that my user is authorized even through i have added the authentication header with the correct credentials.
I have been looking at different examples online but I just can't seem to find out where my mistake was.
My UserDetailsService holds one user named batman that has a USER role that is required for POSTing to /books/book
#Component
public class CustomUserDetailsService implements UserDetailsService {
#Override
public UserDetails loadUserByUsername(String string) throws UsernameNotFoundException {
return User.withDefaultPasswordEncoder().username("batman").password("pass").roles("ADMIN", "USER").build();
}
}
My SecurityConfig should allow a GET request for unauthorized users to /book/books. This part works.
A POST method to /book/books should be allowed only for authorized users. This part does not work and is returning unauthorized for everyone.
#EnableWebSecurity
public class CustomSecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
private CustomUserDetailsService customUserDetailsService;
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().and().cors().disable().authorizeRequests()
.antMatchers(HttpMethod.GET, "/books/book").permitAll()
.antMatchers(HttpMethod.POST, "/books/**").hasRole("ADMIN")
.and()
.httpBasic();
}
}
My BookController looks like this
#RestController
#RequestMapping("/books")
public class BookController {
#Autowired
private BookService bookService;
#GetMapping("/book")
public ResponseEntity<Object> getAll() {
return new ResponseEntity<>(bookService.getAll(), HttpStatus.OK);
}
#PostMapping("/book")
public ResponseEntity<Object> add(#RequestBody Book book) {
bookService.addBook(book);
return ResponseEntity.ok().build();
}
}
My BookService
#Service
public class BookService {
#Autowired
private BookRepository bookRepository;
public Collection getAll() {
return bookRepository.findAll();
}
public void addBook(Book book) {
bookRepository.save(book);
}
public void deleteBook(Long id) {
bookRepository.deleteById(id);
}
public void updateBook(Long id, Book book){
bookRepository.findById(id).map((entry) -> {
entry.setTitle(book.getTitle());
bookRepository.save(book);
return entry;
});
}
}
My BookRepository
#Repository
public interface BookRepository extends JpaRepository<Book, Long>{
List<Book> findBookByTitle(String title);
}
My Book class
#AllArgsConstructor
#NoArgsConstructor
#Data
#Entity
public class Book {
#Id
#GeneratedValue
private Long id;
private String title;
}
The expected result is unauthorized GET request to /books/book and authorized POST request to /book/books

Answer 1

Are you using Spring Boot?
One thing that seems strange to me is that you are not doing anything with your CustomUserDetailsService.
try adding to CustomSecurityConfig
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService());
}

Answer 2

The problem was with the version of my Spring dependencies. When I upgraded the version the problem no longer occured.