title: Spring cloud gateway returns 403 for all post requests when security enabled
body: <p>I have the following services:</p>
  <p>Eureka server</p>
  <p>Auth server</p>
  <ul>
  <li>Spring Gateway</li>
  <li>This will pass the login request to the login service</li>
  <li>All other requests will be authenticated(using jwt token and secret key) and passed to other services</li>
  </ul>
  <p>Login Service</p>
  <ul>
  <li>To validate login and issue jwt token</li>
  </ul>
  <p>Below is my config. The flow is not even reaching to this code..</p>
  <pre><code>@Configuration
  @EnableWebFluxSecurity
  @EnableReactiveMethodSecurity
  public class SecurityConfig {
      private static final Logger LOGGER = LoggerFactory.getLogger(SecurityConfig.class);
  
      @Autowired
      private AuthenticationManager authenticationManager;
          
      @Autowired
      private SecurityContextRepository securityContextRepository;
      
  
      @Bean(value=&quot;org.springframework.security.config.annotation.web.reactive.WebFluxSecurityConfiguration.WebFilterChainFilter&quot;)
      public SecurityWebFilterChain springSecurityWebFilterChainFilter(ServerHttpSecurity http) {
          LOGGER.info(&quot;In the securiry config..................&quot;);
          return http
                  .csrf().disable()
              .exceptionHandling()
              .authenticationEntryPoint((swe, e) -&gt; {
                  return Mono.fromRunnable(() -&gt; {
                      swe.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
                  });
              }).accessDeniedHandler((swe, e) -&gt; {
                  return Mono.fromRunnable(() -&gt; {
                      swe.getResponse().setStatusCode(HttpStatus.FORBIDDEN);
                  });
              })
              .and()
              .authenticationManager(authenticationManager)
              .securityContextRepository(securityContextRepository)
              .authorizeExchange()
              .pathMatchers(HttpMethod.OPTIONS).permitAll()
              .pathMatchers(&quot;/login-service/api/login&quot;).permitAll()
              .anyExchange().authenticated()
              .and().build();
      }
  }
  </code></pre>
  <p>I always get <code>403</code> with <code>An expected CSRF token cannot be found</code> this error even though I have disabled csrf.
  Can anyone help what can be wrong here?</p>