title: Spring Security 5 / Login / REST API Accessibility / Bad Credentials even if they are right?
body: <p>I am implementing a REST API using Spring Boot (2.0.1) to work with MongoDB (3.6). I'm really stuck. I've also tried other tips from StackOverFlow but it didn't help for some reason.</p>
  
  <p>I have configured the SecurityConfig.java to permit the access to certain areas and also created a User inMemoryAuthentication, to be able to login to HAL Browser (Spring) and etc. But the problem is, that whatever address I put in browser I get a Login form and the credentials used in the inMemoryAuthentication is always wrong for some reason. The only way I've found to access the API is by excluding SecurityAutoConfiguration in the main class. But this opens up every permission to access everything including HAL Browser without authentication. </p>
  
  <p>Would someone show me what I am doing wrong? I want to permit only certain paths/addresses to everyone, permit everything else only to use with TokenAuthentication (have already a custom implementation of it) and have one user (username, password) to access HAL Browser.</p>
  
  <p>Here is my SecurityConfig.java:</p>
  
  <pre><code>public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private UserService userService;
  
      @Autowired
      private final TokenAuthenticationService tokenAuthenticationService;
  
      @Autowired
      protected SecurityConfig(final TokenAuthenticationService tokenAuthenticationService) {
          super();
          this.tokenAuthenticationService = tokenAuthenticationService;
      }
  
      @Override
      protected void configure(final HttpSecurity http) throws Exception {
          http.csrf().disable()
                  .addFilterBefore(new TokenAuthenticationFilter(tokenAuthenticationService), UsernamePasswordAuthenticationFilter.class)
                  .authorizeRequests()
                  .antMatchers("/hello").permitAll()
                  .antMatchers("/test2").permitAll()
                  .antMatchers("/register").permitAll()
                  .antMatchers("/useraccount").permitAll()
                  .anyRequest().authenticated()
                  .and()
                  .formLogin().permitAll()
                  .and()
                  .logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout")).permitAll();
      }
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  //      auth
  //              .inMemoryAuthentication()
  //              .withUser("user1").password("password").roles("ADMIN");
          auth
                  .inMemoryAuthentication()
                  .withUser(User.withDefaultPasswordEncoder().username("user").password("password").roles("USER"));
  //      auth
  //              .userDetailsService(userService);
      }
  
  //    @Bean
  //    @Override
  //    public UserDetailsService userDetailsService() {
  //        UserDetails user =
  //                User.withDefaultPasswordEncoder()
  //                        .username("user")
  //                        .password("password")
  //                        .roles("USER")
  //                        .build();
  //
  //        return new InMemoryUserDetailsManager(user);
  //    }
  
  //    @Bean
  //    public UserDetailsService userDetailsService() {
  //        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
  //        manager.createUser(User.withUsername("user").password("pass").roles("USER", "ADMIN").build());
  //        return manager;
  //    }
  
  }
  </code></pre>
  
  <p>I've tried different approaches as you see (commented blocks) but still no luck.
  Even though I have <code>permitAll()</code> on <code>/register</code>, i still get the auto generated login form, which won't accept any credentials. </p>
  
  <p>So as i've said earlier the only way to use my API is to exclude the SecurityAutoConfiguration (<code>@EnableAutoConfiguration(exclude = SecurityAutoConfiguration.class</code>) but it is not a secure option.</p>
  
  <p>Is there any way to resolve this?</p>