Spring Security 403 Error While Trying To Add a New User

I have been trying to add a create method to my spring boot security app but, when I use post mapping I get that error. Also, my id is auto-incremented in db. I am not sure but maybe the error is because of it. I don't know how to write an auto-incremented value in the request body.

{"timestamp":"2020-08- 
   23T00:43:31.062+00:00","status":403,"error":"Forbidden","message":"","path":"/createUser"}
The body that i am trying to post:
{
    "id": 3,
    "userName": "Adminn",
    "password": "pss",
    "active": true,
    "role": "ROLE_ADMIN"
}

Request Body for Post Mapping
[1]: https://i.stack.imgur.com/uqoD0.png

My home resource class

package io.javabrains.springsecurity.jpa;

@RestController
public class HomeResource {
@Autowired
private UserRepository userRepo;

@GetMapping("/")
public String home() {
    return ("<h1>Welcome</h1>");
}

@GetMapping("/user")
public String user() {
    return ("Welcome User");
}

@GetMapping("/admin")
public String admin() {
    return ("<h1>Welcome Admin</h1>");
}


@GetMapping("/users/{id}")  
public Optional<User> retriveUser(@PathVariable int id)  
{  
	return userRepo.findById(id);
	
}  

@PostMapping("/createUser")
public void createUser(@RequestBody User myuser) {
	
	User savedUser=userRepo.save(myuser);
	 
}
/*@GetMapping("/createUser") // it is working
public String addUser() {
    User newuser= new User();
    newuser.setUserName("new");
    newuser.setPassword(new BCryptPasswordEncoder().encode("pass"));
    newuser.setRole("ROLE_ADMIN");
    newuser.setActive(true);
	userRepo.save(newuser);
	
	return 	"user booked";
}*/

}

My Spring App Class

@SpringBootApplication
@EnableJpaRepositories(basePackageClasses = UserRepository.class)
public class SpringsecurityApplication implements CommandLineRunner{

@Autowired
 UserRepository userRepository;

public static void main(String[] args) {
	SpringApplication.run(SpringsecurityApplication.class, args);
}

@Override
public void run(String... args) throws Exception {
	// TODO Auto-generated method stub
	System.out.println("Application Running.");
    User adminUser= new User();
    adminUser.setUserName("Admin");
    adminUser.setPassword(new BCryptPasswordEncoder().encode("pass"));
    adminUser.setRole("ROLE_ADMIN");
    adminUser.setActive(true);
    userRepository.save(adminUser);
    User newUser= new User();
    newUser.setUserName("User");
    newUser.setPassword(new BCryptPasswordEncoder().encode("pass"));
    newUser.setRole("ROLE_USER");
    newUser.setActive(true);
    userRepository.save(newUser);
}

}

User Class

 package io.javabrains.springsecurity.jpa.models;
    @Entity
    @Table(name="app_user")
    public class User {
	@Id
	@GeneratedValue(strategy =GenerationType.AUTO)
	private int id;
	private String userName;
	private String password;
	private boolean active;
	private String role;
	public int getId() {
		return id;
	}
	public void setId(int id) {
		this.id = id;
	}
	public String getUserName() {
		return userName;
	}
	public void setUserName(String userName) {
		this.userName = userName;
	}
	public String getPassword() {
		return password;
	}
	public void setPassword(String password) {
		this.password = password;
	}
	public boolean isActive() {
		return active;
	}
	public void setActive(boolean active) {
		this.active = active;
	}
	public String getRole() {
		return role;
	}
	public void setRole(String role) {
		this.role = role;
	}
	
    }

Security Config Class

 package io.javabrains.springsecurity.jpa;
   @EnableWebSecurity
   public class SecurityConfiguration extends WebSecurityConfigurerAdapter{
	
	@Bean
	public BCryptPasswordEncoder bCryptPasswordEncoder ()
	{
		return new BCryptPasswordEncoder();
	}
	
	
	@Autowired
	UserDetailsService userDetailsService;
	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
		
	}

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.authorizeRequests()
			
			.antMatchers("/admin").hasAnyRole("ADMIN")
			.antMatchers("/user").hasAnyRole("ADMIN","USER")
			.antMatchers("/","/createUser").permitAll()
			.and().formLogin();
	}


    }

What if you modify your code this way:

.antMatchers(HttpMethod.POST, "/createUser").permitAll()

Because CSRF protection for state-changing HTTP verbs, such as POST, is enabled by default. You can either disable it or include CSRF token in your web page, and subsequently in your HTTP request.

First of all is a bad practice try to map the JSON request to an entity class. First you should use a DTO class.
Do that first and see what happend