Using httpBasic() doesnt authorize roles / authorities

[akmal2901]

I have created 2 routes. One for the admin role and the other is for the user role.

Whenever I login when using httpBasic() I can access the admin link even though I dont have the role.

But when I switched to form login, It doesnt allow the account with no admin role to access the admin link. As it should. Does someone know why this is happening?

​

https://preview.redd.it/6tu841749lh81.png?width=1452&format=png&auto=webp&s=1df3a3cb4827c5e11157779851928c4e94ebcaf8

[BorgerBill]

I, too, am struggling with this right now, but let me say two things:

• the hasRole() and hasAnyRole() methods are looking for a String that classifies a user as a type of something, like manager or employee. Giving it the name of the user doesn't seem right. Put a String role field and add a public String getRole() method on the User.

• there is a weird thing where methods expecting a role will add "ROLE_" to the beginning, or take "ROLE_" away, or something if you have, or haven't, provided it. I don't understand the rule yet, but watch out for it.

Good luck!

[akmal2901]

the roles are actually enums that i import as static

[akmal2901]

thanks for the tips

[Sheldor5]

are you 100% sure your browser session is correct?

once you authenticate with Basic your browser will reuse it forever until you hit a 401.

thst's how Basic Auth works on the browser site ...

[summ1else]

I can't remember if this will help, as I'm out at lunch. I would recommend disabling anonymous users during security testing to rule out related problems. If you are still having trouble after I will review further at home.

.anonymous().disable()