title: There was an unexpected error (type=Forbidden, status=403).Forbiden
body: <p>I'm new in spring.
  I was trying to add a new goal to my database. Before I add spring security it's worked, but now if I click to add a new goal, I have a problem :</p>
  <p>There was an unexpected error (type=Forbidden, status=403).
  Forbidden</p>
  <p>My goat-add.html :</p>
  <pre><code>&lt;!DOCTYPE HTML&gt;
  &lt;html xmlns:th=&quot;http://www.thymeleaf.org&quot;&gt;
  &lt;head&gt;
      &lt;title&gt;Goals&lt;/title&gt;
      &lt;meta http-equiv=&quot;Content-Type&quot; content=&quot;text/html; charset=UTF-8&quot; /&gt;
      &lt;link rel=&quot;stylesheet&quot; href=&quot;https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css&quot;&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;header th:insert=&quot;blocks/header :: header&quot;&gt;&lt;/header&gt;
  
  &lt;div class=&quot;container mt-5 mb-5&quot;&gt;
      &lt;h1&gt;Your goals&lt;/h1&gt;
      &lt;form action=&quot;/goal/add&quot; method=&quot;post&quot;&gt;
          &lt;input type=&quot;text&quot; name=&quot;name&quot; placeholder=&quot;Write your goal name&quot; class=&quot;form-control&quot;&gt;&lt;br&gt;
          &lt;textarea type=&quot;text&quot; name=&quot;description&quot; placeholder=&quot;Write your goal description&quot; class=&quot;form-control&quot;&gt;&lt;/textarea&gt;&lt;br&gt;
          &lt;button type=&quot;submit&quot; class=&quot;btn btn-success&quot;&gt;Add goal&lt;/button&gt;
      &lt;/form&gt;
  &lt;/div&gt;
  
  &lt;div th:insert=&quot;blocks/footer :: footer&quot;&gt;&lt;/div&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  <p>WebSecurityConfig class :</p>
  <pre><code>package com.evgzabozhan.GoatGoal.config;
  import com.evgzabozhan.GoatGoal.service.UserService;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.crypto.password.NoOpPasswordEncoder;
  
  
  @Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      @Autowired
      private UserService userService;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .authorizeRequests()
                  .antMatchers(&quot;/login&quot;,&quot;/registration&quot;).permitAll()
                  .anyRequest().authenticated()
                  .and()
                  .formLogin()
                  .loginPage(&quot;/login&quot;)
                  .permitAll()
                  .and()
                  .logout()
                  .permitAll();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userService)
                  .passwordEncoder(NoOpPasswordEncoder.getInstance());
      }
  }
  </code></pre>
  <p>My controller :</p>
  <pre><code>package com.evgzabozhan.GoatGoal.controller;
  
  import com.evgzabozhan.GoatGoal.model.Goal;
  import com.evgzabozhan.GoatGoal.model.User;
  import com.evgzabozhan.GoatGoal.repository.GoalRepository;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.security.core.annotation.AuthenticationPrincipal;
  import org.springframework.stereotype.Controller;
  import org.springframework.ui.Model;
  import org.springframework.web.bind.annotation.GetMapping;
  import org.springframework.web.bind.annotation.PathVariable;
  import org.springframework.web.bind.annotation.PostMapping;
  import org.springframework.web.bind.annotation.RequestParam;
  
  import java.util.*;
  
  @Controller
  public class GoalController {
  
      @Autowired
      private GoalRepository goalRepository;
  
      @GetMapping(&quot;/goal&quot;)
      public String goal(Model model){
          Iterable&lt;Goal&gt; goals = goalRepository.findAll();
          model.addAttribute(&quot;goals&quot;,goals);
          return &quot;goal/goal-main&quot;;
      }
  
      @GetMapping(&quot;/goal/add&quot;)
      public String getGoalAdd(Model model){
          return &quot;goal/goal-add&quot;;
      }
  
      @PostMapping(&quot;/goal/add&quot;)
      public String postGoalAdd(@AuthenticationPrincipal User user,
                                @RequestParam String name,
                                @RequestParam String description, Model model){
  
          Goal goal = new Goal(name,description,user);
          goalRepository.save(goal);
          model.addAttribute(&quot;message&quot;,user.getUsername());
          return &quot;redirect:/goal&quot;;
      }
  
      @GetMapping(&quot;/goal/{id}&quot;)
      public String goalInfo(@PathVariable(value = &quot;id&quot;) long id, Model model) {
          if (!goalRepository.existsById(id)) {
              return &quot;redirect:/goal&quot;;
          }
  
          Optional&lt;Goal&gt; goal = goalRepository.findById(id);
          ArrayList&lt;Goal&gt; result = new ArrayList&lt;&gt;();
          goal.ifPresent(result::add);
          model.addAttribute(&quot;goal&quot;, result);
          return &quot;goal/goal-info&quot;;
      }
  
      @GetMapping(&quot;/goal/{id}/edit&quot;)
      public String goalEdit(@PathVariable(value = &quot;id&quot;) long id, Model model){
          if (!goalRepository.existsById(id)) {
              return &quot;redirect:/goal&quot;;
          }
  
          Optional&lt;Goal&gt; goal = goalRepository.findById(id);
          ArrayList&lt;Goal&gt; result = new ArrayList&lt;&gt;();
          goal.ifPresent(result::add);
          model.addAttribute(&quot;goal&quot;, result);
          return &quot;goal/goal-edit&quot;;
      }
  
      @PostMapping(&quot;/goal/{id}/edit&quot;)
      public String postGoalUpdate(@PathVariable(value = &quot;id&quot;) long id,
                                   @RequestParam String name,
                                   @RequestParam String description,
                                   Model model){
          Goal goal = goalRepository.findById(id).orElseThrow();
          goal.setName(name);
          goal.setDescription(description);
          goalRepository.save(goal);
          return &quot;redirect:/goal&quot;;
      }
  
      @PostMapping(&quot;/goal/{id}/remove&quot;)
      public String postGoalRemove(@PathVariable(value = &quot;id&quot;) long id, Model model){
          Goal goal = goalRepository.findById(id).orElseThrow();
          goalRepository.delete(goal);
          return &quot;redirect:/goal&quot;;
      }
  }
  
  </code></pre>
  <p>I read this problem can be if don't use csrf, but I don't understand how I can fix it.</p>
  <p>All code there: <a href="https://github.com/evgzabozhan/GoatGoal" rel="nofollow noreferrer">https://github.com/evgzabozhan/GoatGoal</a></p>
  <p>Thanks for your help!</p>