title: Postman showing HTML instead of JSON
body: <p>I have a simple Spring Boot + Spring Security REST app with quotations. Only 3 endpoints for GET, POST, DELETE. Only moderator and admin accounts defined. GET rest method works fine - it shows list of quotations. The problem is with POST and DELETE methods. When I try to invoke them in Postman it returns HTML (logging form defined in SecurityConfig).</p>
  
  <p><strong>QuotationApi.java</strong></p>
  
  <pre class="lang-java prettyprint-override"><code>@RestController
  public class QuotationApi {
  
      private List&lt;Quotation&gt; quotations;
  
      public QuotationApi() {
          this.quotations = new ArrayList&lt;&gt;();
          quotations.add(new Quotation("Those who dare to fail miserably can achieve greatly.", "John F. Kennedy"));
          quotations.add(new Quotation("Get busy living or get busy dying.", "Stephen King"));
      }
  
      @GetMapping("/api")
      public List&lt;Quotation&gt; getQuotation() {
          return quotations;
      }
  
      @PostMapping("/api")
      public boolean addQuotation(@RequestBody Quotation quotation) {
          return quotations.add(quotation);
      }
  
      @DeleteMapping("/api")
      public void deleteQuotation(@RequestParam int index) {
          quotations.remove(index);
      }
  }
  </code></pre>
  
  <p><strong>SecurityConfig.java</strong></p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      // creating users
      @Bean
      public UserDetailsService userDetailsService() {
  
          UserDetails moderator = User.withDefaultPasswordEncoder()
                  .username("user")
                  .password("user")
                  .roles("MODERATOR")
                  .build();
  
          UserDetails admin = User.withDefaultPasswordEncoder()
                  .username("admin")
                  .password("admin")
                  .roles("ADMIN")
                  .build();
  
          return new InMemoryUserDetailsManager(moderator, admin);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.authorizeRequests()
                  .antMatchers(HttpMethod.GET,"/api").permitAll()
                  .antMatchers(HttpMethod.POST,"/api").hasRole("MODERATOR")
                  .antMatchers(HttpMethod.DELETE,"/api").hasRole("ADMIN")
                  .anyRequest().hasRole("ADMIN")
                  .and()
                  .formLogin().permitAll()
                  .and()
                  .logout().permitAll()
                  .and()
                  .csrf().disable();
      }
  }
  </code></pre>
  
  <p>I have Basic_auth in Postman:
  <a href="https://i.stack.imgur.com/o672A.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/o672A.png" alt="enter image description here"></a></p>
  
  <p>EDIT after Andreas's help (working code):</p>
  
  <pre class="lang-java prettyprint-override"><code>@Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.authorizeRequests()
                  .antMatchers(HttpMethod.GET,"/api").permitAll()
                  .antMatchers(HttpMethod.POST,"/api").hasRole("MODERATOR")
                  .antMatchers(HttpMethod.DELETE,"/api").hasRole("ADMIN")
                  .anyRequest().hasRole("ADMIN")
                  .and()
                  .httpBasic()
                  .and()
                  .formLogin().permitAll()
                  .and()
                  .logout().permitAll()
                  .and()
                  .csrf().disable();
      }
  </code></pre>