Q: Spring security authorization based on ROLES not working In a Spring boot / spring security / Angular JS application..
I am trying to allow the below pages only if the user has a specified role.
.antMatchers("/1_reportingEntities/*.html").hasAnyRole(roles)

But it allow the page even if that role is not set for the user.
What am I missing ?
Java Code
    @Override
    protected void configure(HttpSecurity http) throws Exception {

        String roles [] = new String[] {"ROLE_EDITOR", "ROLE_AUTHORISER" };

        http.httpBasic()
                .and()
                .authorizeRequests()

                // Permit these resources
                .antMatchers("/login", "/4_security/login.html", "/bower_components/**", "/0_common/*.html", "/1_reportingEntities/*.js",
                        "/2_dataCollections/*.js", "/3_calendar/*.js", "/4_security/*.js", "/")
                .permitAll()
                // All other requests needs authentication
                .anyRequest().authenticated()

                // Allow only if has certain roles  
                .antMatchers("/1_reportingEntities/*.html").hasAnyRole(roles)

                .and()
                // CSRF protection
                .csrf().csrfTokenRepository(csrfTokenRepository()).and().addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);

        // Enable https
        http.requiresChannel().anyRequest().requiresSecure();

    }


A: I suppose problem is with Spring. You need to change hasAnyRole() for hasAnyAuthority().

A: Spring will automatically add the prefix ROLE_ when checking with hasAnyRole, whereas hasAnyAuthority will not.
So, in your example when you use hasAnyRole({"ROLE_EDITOR", "ROLE_AUTHORISER" }) , Spring will actually check if your user has either of the roles {"ROLE_ROLE_EDITOR", "ROLE_ROLE_AUTHORISER" }.
You can either use hasAnyRole({"EDITOR", "AUTHORISER"}), which will check if your user has been granted {"ROLE_EDITOR", "ROLE_AUTHORISER"}, or you can keep specifying {"ROLE_EDITOR", "ROLE_AUTHORISER" } but use hasAnyAuthority.
