title: Bypass spring security with java URL connection
body: <p>I am using Spring MVC in my project and while mapping user request to a URI, I was unable to bypass it. I get the 403 error as the url is intercepted. But i was able to access it through browser.</p>
  
  <p><em>Updated</em></p>
  
  <blockquote>
    <p>I removed the interception in security.xml and when i try to hit i get the following error.</p>
    
    <p><strong>Request method 'POST' not supported</strong></p>
  </blockquote>
  
  <pre><code>http://49.205.88.200:5080/Batasariservice/groupview.htm
  username :  userx@bat
  password :  123456
  </code></pre>
  
  <p><em>Updated:</em></p>
  
  <p><strong>My Rest Controller:</strong></p>
  
  <pre><code> @RestController
  public class AuthenticateDeviceRestWS {
  
      @Autowired
      ManageDeviceWSBusiness manageDeviceWSBusiness;
  
      @RequestMapping(value = "authAndRegDevice.htm", method = RequestMethod.POST)
      public @ResponseBody String authenticateAndRegisterDevice(
              @RequestBody String notificationJsonRequest)
              throws BatasariWSException {
          WSDeviceAuthenticateRequest wsDeviceAuthenticateRequest = (WSDeviceAuthenticateRequest) UserAccessManagementUtil
                  .convertToJava(notificationJsonRequest,
                          WSDeviceAuthenticateRequest.class);
  
          WSDeviceAuthenticateResponse wsDeviceAuthenticateResponse = manageDeviceWSBusiness
                  .authAndRegisterDevice(wsDeviceAuthenticateRequest);
  
          return UserAccessManagementUtil
                  .convertToJson(wsDeviceAuthenticateResponse);
      }
  
  }
  </code></pre>
  
  <p><em>Updated</em>
  Java Main class i.e., tested with</p>
  
  <pre><code>public class AuthURLConnection {
  static String URL = "http://localhost:5080/Batasariservice/authAndRegDevice.htm";
  
  public static void main(String[] args) {
      // TODO Auto-generated method stub
      String json = "{ " + "\"deviceID\":\"Test\", "
              + "\"deviceName\":\"Test Device\",  "
              + "\"phoneNumber\":\"testnumber\",   "
              + "\"companyIdentifier\":\"bat\",   "
              + "\"userIdentifier\":\"Test\",   " + "\"addtionalInfo\":\"\""
              + "}";
      wsRequest(json);
  
  }
  
  private static void wsRequest(String jsonInput) {
  
      try {
  
          URL targetUrl = new URL(URL);
          HttpURLConnection httpConnection = (HttpURLConnection) targetUrl
                  .openConnection();
  
          httpConnection.setDoOutput(true);
          httpConnection.setRequestMethod("POST");
          httpConnection.setRequestProperty("Content-Type",
                  "application/json");
  
  
  
          OutputStream outputStream = httpConnection.getOutputStream();
          outputStream.write(jsonInput.getBytes());
          outputStream.flush();
  
          if (httpConnection.getResponseCode() != 200) {
              throw new RuntimeException("Failed : HTTP error code : "
                      + httpConnection.getResponseCode() + ":"
                      + httpConnection.getResponseMessage());
          }
  
          BufferedReader responseBuffer = new BufferedReader(
                  new InputStreamReader(httpConnection.getInputStream()));
  
          String output;
          StringBuffer sb = new StringBuffer();
          while ((output = responseBuffer.readLine()) != null) {
              sb.append(output);
          }
  
          httpConnection.disconnect();
  
      } catch (MalformedURLException e) {
  
          e.printStackTrace();
  
      } catch (IOException e) {
  
          e.printStackTrace();
  
      }
  
  }
  </code></pre>
  
  <p>}</p>
  
  <p><em>Updated</em>
  my spring-security.xml file </p>
  
  <pre><code>&lt;http auto-config="true" use-expressions="true"&gt;
          &lt;intercept-url pattern="/userLogin*" access="permitAll" /&gt;
          &lt;intercept-url pattern="/authAndRegDevice.htm" access="permitAll" /&gt;
          &lt;intercept-url pattern="/css/**" access="permitAll" /&gt;
          &lt;intercept-url pattern="/**" access="hasRole('DefaultRole')" /&gt;
  
          &lt;!-- access denied page --&gt;
          &lt;access-denied-handler error-page="/403" /&gt;
  
          &lt;form-login login-page="/userLogin.htm" default-target-url="/groupview.htm"
              authentication-failure-url="/userLogin.htm?error" username-parameter="username"
              password-parameter="password" authentication-success-handler-ref="authSuccessHandler" /&gt;
  
          &lt;csrf /&gt;
      &lt;/http&gt;
  
      &lt;beans:bean id="authSuccessHandler"
          class="com.pathfinder.filter.AuthenticationSuccessHandlerImpl" /&gt;
      &lt;beans:bean id="encoder"
          class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/&gt;
  
  
          &lt;authentication-manager&gt;
              &lt;authentication-provider&gt;
                  &lt;password-encoder ref="encoder" /&gt;
                  &lt;jdbc-user-service data-source-ref="dataSource"
                      users-by-username-query="select username,password, status from users where username=?"
                      authorities-by-username-query="select username, 'DefaultRole' as role from userrolesview where username =?  " /&gt;
              &lt;/authentication-provider&gt;
          &lt;/authentication-manager&gt;
  </code></pre>