title: Spring Security 4.1 upgrade - HttpServletRequest isUserInRole returning false
body: <p>After login successfully, isUserInRole method of HttpServletRequest class is returning false. It was returning true prior to Spring Security version upgrade to 4.1.3.</p>
  
  <p>spring-security-core-4.1.3, spring-security-web-4.1.3, and spring-security-config-4.1.3 jars are present in the class-path</p>
  
  <p>Spring-Security.xml</p>
  
  <pre><code> ...
  &lt;spring:bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter"&gt;
  &lt;/spring:bean&gt;
  
  &lt;spring:bean id="authenticatedVoter" class="org.springframework.security.access.vote.AuthenticatedVoter"/&gt;
  
  &lt;spring:bean id="webExpressionVoter" class="org.springframework.security.web.access.expression.WebExpressionVoter" /&gt;
  
  &lt;spring:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"&gt;
        &lt;spring:constructor-arg&gt;
         &lt;spring:list&gt;
              &lt;spring:ref bean="roleVoter"/&gt;
              &lt;spring:ref bean="authenticatedVoter"/&gt;
              &lt;spring:ref bean="webExpressionVoter"/&gt;
          &lt;/spring:list&gt;
    &lt;/spring:constructor-arg&gt;
  &lt;/spring:bean&gt;
  
  &lt;security:http access-decision-manager-ref="accessDecisionManager" use-expressions="true"&gt;
  
      &lt;security:intercept-url pattern="/login.jsp" access="hasAuthority('ROLE_ANONYMOUS')" /&gt;
  
      &lt;security:intercept-url pattern="/index*" access="hasAuthority('ROLE_USER')"/&gt;
  
      &lt;security:form-login login-page="/login.jsp"
          username-parameter="j_username"
          password-parameter="j_password"
          login-processing-url="/j_spring_security_check"
          authentication-failure-url="/accessDenied.jsp" /&gt;
  
      &lt;security:logout invalidate-session="true"  delete-cookies="JSESSIONID"/&gt;
  
      &lt;security:csrf disabled="true"/&gt;
  
  &lt;/security:http&gt;
  
  &lt;security:authentication-manager alias="secAuthManager"&gt;
      &lt;security:authentication-provider ref="securityProvider" /&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;spring:bean id="securityProvider" class="com.SecurityProvider"/&gt;
  
  ...
  </code></pre>
  
  <p>class SecurityProvider</p>
  
  <pre><code>    public class SecurityProvider implements AuthenticationProvider {
  
          @Override
          public Authentication authenticate(Authentication authentication) throws AuthenticationException {
  
  ...
  
                  List&lt;GrantedAuthority&gt; grantedAuthorities = ...                 
  
  return new UsernamePasswordAuthenticationToken(user, password, grantedAuthorities);
          }
  
          @Override
          public boolean supports(Class&lt;?&gt; authentication) {
              return authentication.equals(UsernamePasswordAuthenticationToken.class);
          }
      }
  </code></pre>
  
  <p>If I replaces 4.1.3 security jars with 3.2.9 version and remove <code>&lt;security:csrf disabled="true"/&gt;</code> from Spring-Security.xml then it works.</p>