title: 403 forbidden when I try to post to my spring api?
body: <p>Using postman, I can get a list of users with a get request to:  <code>http://localhost:8080/users</code>.</p>
  
  <p>But when I send a post request to the same address, I get a 403 error.</p>
  
  <pre><code>@RestController
  public class UserResource {
  
      @Autowired
      private UserRepository userRepository;
  
      @GetMapping("/users")
      public List&lt;User&gt; retrievaAllUsers() {
          return userRepository.findAll();
      }
  
  
          @PostMapping("/users")
          public ResponseEntity&lt;Object&gt; createUser(@RequestBody User user) {
              User savedUser = userRepository.save(user);
  
              URI location = ServletUriComponentsBuilder.fromCurrentRequest()
                      .path("/{id}")
                      .buildAndExpand(savedUser.getId())
                      .toUri();
  
              return ResponseEntity.created(location).build();
  
          }
  
  
      }
  
  
  @EnableWebSecurity
  @Configuration
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private UserDetailsService userDetailsService;
  
      /*@Override
      public void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth
                  .userDetailsService(userDetailsService)
                  .passwordEncoder(new BCryptPasswordEncoder());
      }*/
  
  
      /*@Override
      protected void configure(HttpSecurity http) throws Exception {
          http.httpBasic().and().authorizeRequests()
                  .antMatchers("/users/**").hasRole("ADMIN")
                  .and().csrf().disable().headers().frameOptions().disable();
      }*/
  }
  
  @Entity
  @Table(name = "user")
  public class User {
  
      @Id
      @GeneratedValue
      private Long id;
      private String name;
      private String password;
      @Enumerated(EnumType.STRING)
      private Role role;
  
      // TODO which cna be removed
  
      public User() {
          super();
      }
  
      public User(Long id, String name, String password, Role role) {
          this.id = id;
          this.name = name;
          this.password = password;
          this.role = role;
      }
  
      public Long getId() {
          return id;
      }
  
      public void setId(Long id) {
          this.id = id;
      }
  
      public String getName() {
          return name;
      }
  
      public void setName(String name) {
          this.name = name;
      }
  
      public String getPassword() {
          return password;
      }
  
      public void setPassword(String password) {
          this.password = password;
      }
  
      public Role getRole() {
          return role;
      }
  
      public void setRole(Role role) {
          this.role = role;
      }
  }
  
  
  
  
  
      @Repository
      public interface UserRepository extends JpaRepository&lt;User, Long&gt; {
  
  
      }
  
  
  
  
  
  
  INSERT INTO user VALUES (1, 'user1', 'pass1', 'ADMIN'); 
  INSERT INTO user VALUES (2, 'user2', 'pass2', 'USER'); 
  INSERT INTO user VALUES (3,'user3', 'pass3', 'ADMIN')
  </code></pre>
  
  <p>EDIT</p>
  
  <p><a href="https://i.stack.imgur.com/6bIlQ.png" rel="noreferrer"><img src="https://i.stack.imgur.com/6bIlQ.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/em9PR.png" rel="noreferrer"><img src="https://i.stack.imgur.com/em9PR.png" alt="enter image description here"></a></p>
  
  <p>EDit 2</p>
  
  <p>added delete, but it also gives a 403?</p>
  
  <pre><code>@DeleteMapping("/users/{id}")
  </code></pre>
  
  <p>public void deleteUser(@PathVariable long id) {
      userRepository.deleteById(id);
  }</p>
  
  <p><a href="https://i.stack.imgur.com/ktokx.png" rel="noreferrer"><img src="https://i.stack.imgur.com/ktokx.png" alt="enter image description here"></a></p>
  
  <p>edit 4</p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  
      public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http.authorizeRequests()
                      .antMatchers("/users/**").permitAll();
  
          }
      }
  
  
  
  @Configuration
  @EnableAutoConfiguration
  @ComponentScan
  public class Application extends SpringBootServletInitializer {
  
      public static void main(String[] args) {
          SpringApplication.run(Application.class, args);
      }
  
  
  }
  </code></pre>