I’m developing a backend application using Spring. The user registration API is functioning correctly, and it creates entries in the database. However, attempting to execute a GET request results in a 401 Unauthorized error.
I’ve activated basic authentication in Postman and entered the credentials of an existing user, yet I still encounter the same 401 error. Can anyone help me identify what might be causing this issue?
Here’s the relevant code snippets for your reference:
Security Configuration
package com.example.app.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
public class SecurityConfiguration {
@Bean
public BCryptPasswordEncoder getPasswordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public SecurityFilterChain configureSecurity(HttpSecurity http) throws Exception {
http
.csrf().disable() // CSRF is disabled for testing purposes;
.authorizeHttpRequests(req -> req
.requestMatchers("/api/users/signup").permitAll() // Allow signup without auth
.anyRequest().authenticated() // Requires authentication for other requests
)
.httpBasic(); // Enables basic auth
return http.build();
}
}
User Controller
package com.example.app.controller;
import com.example.app.model.User;
import com.example.app.service.UserManagementService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;
@RestController
@RequestMapping("/api/users")
public class UserController {
private final UserManagementService userManagementService;
@Autowired
public UserController(UserManagementService userManagementService) {
this.userManagementService = userManagementService;
}
@PostMapping("/signup")
public void createUser(@RequestBody User user) {
userManagementService.createUser(user);
}
@GetMapping("/{userId}")
public User getUser(@PathVariable String userId) {
return userManagementService.getUserById(userId);
}
}
User Class
package com.example.app.model;
import jakarta.persistence.*;
@Entity
@Table(name = "application_user")
public class User {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
@Column(unique = true, nullable = false)
private String username;
@Column(nullable = false)
private String password;
public void setPassword(String encoded) {
this.password = encoded;
}
public String getUsername() {
return username;
}
public String getPassword() {
return password;
}
}
User Management Service
package com.example.app.service;
import com.example.app.model.User;
import com.example.app.repository.UserRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;
@Service
public class UserManagementService {
private final UserRepository userRepository;
private final BCryptPasswordEncoder passwordEncoder;
@Autowired
public UserManagementService(UserRepository userRepository, BCryptPasswordEncoder passwordEncoder) {
this.userRepository = userRepository;
this.passwordEncoder = passwordEncoder;
}
public void createUser(User user) {
if (user.getPassword() == null || user.getPassword().isEmpty()) {
throw new IllegalArgumentException("Password cannot be null or empty");
}
if (user.getUsername() == null) {
throw new IllegalArgumentException("Username cannot be null");
}
String encryptedPassword = passwordEncoder.encode(user.getPassword());
user.setPassword(encryptedPassword);
userRepository.save(user);
}
public User getUserById(String userId) {
return userRepository.findByUsername(userId)
.orElseThrow(() -> new RuntimeException("User not found"));
}
}
User Repository
package com.example.app.repository;
import com.example.app.model.User;
import org.springframework.data.jpa.repository.JpaRepository;
import java.util.Optional;
public interface UserRepository extends JpaRepository<User, Long> {
Optional<User> findByUsername(String username);
}
I also attempted to send the request without encoding the password, but the issue remains. If I allow unauthenticated users to access the endpoint, the request goes through successfully.