title: Spring Security MockMVC with @WithMockUser() always returns Successful status
body: <p>I am trying to test some endpoints (I am quite new to testing) and having an issue where the Mocked Authentication seems to always be accepted and returns a 200.</p>
  
  <p>The test without Auth seems to have a user with just a ROLE_USER but the endpoint still returns a success.</p>
  
  <p>I can only assume my SecurityConfig is not being used by the MockMVC instance and a default "let all requests happen" is?</p>
  
  <p>Even changing my Security Config to only allow users with "ROLE_GOD" still results in status.OK for all test requests.</p>
  
  <p>Tried following the Spring Docs and some posts on here and not getting any luck...</p>
  
  <p>Any help would be greatly appreciated.</p>
  
  <pre><code>DataController.getIndex org.springframework.security.authentication.UsernamePasswordAuthenticationToken@ca25360: Principal: org.springframework.security.core.userdetails.User@36ebcb: Username: user; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: ROLE_USER
  </code></pre>
  
  <pre><code>Expected :CLIENT_ERROR
  Actual   :SUCCESSFUL
  </code></pre>
  
  <pre><code>@RunWith(SpringJUnit4ClassRunner.class)
  @ContextConfiguration
  @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
  @AutoConfigureMockMvc
  public class DataControllerTest {
  
      @LocalServerPort
      private int port;
  
      @Autowired
      private MockMvc mockMvc;
  
      @Autowired
      private WebApplicationContext webApplicationContext;
  
      @Before
      public void before() {
          this.mockMvc = MockMvcBuilders.webAppContextSetup(this.webApplicationContext)
                  .apply(springSecurity())
                  .build();
      }
  
      @Test
      @WithMockUser(roles = {"ADMIN"}, setupBefore = TestExecutionEvent.TEST_METHOD)
      public void getRequest() throws Exception {
          System.out.println("!!!" + SecurityContextHolder.getContext().getAuthentication());
          this.mockMvc.perform(get("http://localhost:" + port)).andDo(print())
                  .andExpect(status().is2xxSuccessful())
                  .andExpect(content().string("HELLO!"));
      }
  
      @Test
      @WithMockUser(setupBefore = TestExecutionEvent.TEST_METHOD)
      public void getRequestWithoutAuth() throws Exception {
          System.out.println("!!!" + SecurityContextHolder.getContext().getAuthentication());
          this.mockMvc.perform(get("http://localhost:" + port)).andDo(print())
                  .andExpect(status().is4xxClientError());
      }
  
  }
  </code></pre>
  
  <p>My SecurityConfig:</p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          super.configure(auth);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.cors().disable().csrf().disable()
                  .exceptionHandling()
                  .and()
                  .formLogin().disable()
                  .authorizeRequests()
                  .antMatchers("/").hasRole("ADMIN")
                  .anyRequest().authenticated()
                  .and()
                  .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  
      }
  }
  </code></pre>