Spring Boot Security login success but always return forbidden

I was use Spring Boot Security for my application, and the user role infomation is saved in mysql database. But after user success that always return 403 forbidden, no matter what kind authority user that I has been logined.

Here is my test data record:

id, user_name, password, role, authority, is_enabled
1, "Hedworth", "123", "USER", 1, 1
2, "Geoffrey", "123", "ADMIN", 1, 1

Here is my MySQL entity java bean:

public class TbUser implements Serializable, UserDetails {

    private static final long serialVersionUID = 213034465413641992L;

    private String id;

    private String userName;

    private String password;

    private String role;

    private String authority;

    private Integer isEnabled;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        String[] roles = role.split(",");
        List<SimpleGrantedAuthority> authorities = new ArrayList<>();
        for (String role : roles) {
            authorities.add(new SimpleGrantedAuthority(role));
        }
        return authorities;
    }

    @Override
    public String getUsername() {
        return this.userName;
    }

    @Override
    public String getPassword() {
        return this.password;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return this.isEnabled == 1;
    }

}

The security user role infomation query.

public class TbUserServiceImpl implements TbUserService {

    @Resource
    private TbUserDao tbUserDao;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return tbUserDao.queryByName(username);
    }
}

My Security configuration.

public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private TbUserService tbUserService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(tbUserService)
                .passwordEncoder(new CustomPwdEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
        http.authorizeRequests()
                .antMatchers("/api/user/**").hasRole("USER")
                .antMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .and()
                .httpBasic();
    }
}

When 403 Forbidden occurs, it means that your user is authenticated but he doesn't have enough permissions.

In your case, you are mixing roles/authorities in your configuration.

A role is an authority and can be translated to an authority, prefixing the role with "ROLE_". For example: (Role: USER) -> (Authority: ROLE_USER) or (Role: ADMIN) -> (Authority: ROLE_ADMIN).

You have two choices:

• Use authorities only. Change .antMatchers("/api/user/**").hasRole("USER") to .antMatchers("/api/user/**").hasAuthority("USER")

OR

• Translate your roles. Change authorities.add(new SimpleGrantedAuthority(role)) to authorities.add(new SimpleGrantedAuthority("ROLE_" + role))