I been following this yt tutorial on building a twitter backend spring boot project. When I try making an api call in postman, its showing me the 403 error. Can anyone help me?
Entity class:
@Entity
@Table(name="users")
public class ApplicationUser {
@Id
@GeneratedValue(strategy = GenerationType.AUTO)
@Column(name="user_id")
private Integer userId;
@Column(name="first_name")
private String firstName;
@Column(name="last_name")
private String lastName;
@Column(unique = true)
private String email;
private String phone;
@Column(name="dob")
private Date dateOfBirth;
@Column(unique = true)
private String userName;
@JsonIgnore
//@JsonIgnore is used at field level to mark a property or list of properties to be ignored.
private String password;
@ManyToMany(fetch=FetchType.EAGER)
@JoinTable(
name="user_role_junction",
joinColumns = {@JoinColumn(name="user_id")},
inverseJoinColumns = {@JoinColumn(name="role_id")}
)
private Set<Role> authorities;
public Integer getUserId() {
return userId;
}
public void setUserId(Integer userId) {
this.userId = userId;
}
public String getFirstName() {
return firstName;
}
public void setFirstName(String firstName) {
this.firstName = firstName;
}
public String getLastName() {
return lastName;
}
public void setLastName(String lastName) {
this.lastName = lastName;
}
public String getEmail() {
return email;
}
public void setEmail(String email) {
this.email = email;
}
public String getPhone() {
return phone;
}
public void setPhone(String phone) {
this.phone = phone;
}
public Date getDateOfBirth() {
return dateOfBirth;
}
public void setDateOfBirth(Date dateOfBirth) {
this.dateOfBirth = dateOfBirth;
}
public String getUserName() {
return userName;
}
public void setUserName(String userName) {
this.userName = userName;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public Set<Role> getAuthorities() {
return authorities;
}
public void setAuthorities(Set<Role> authorities) {
this.authorities = authorities;
}
public ApplicationUser(){
this.authorities=new HashSet<>();
}
@Override
public String toString() {
return "ApplicationUser{" +
"userId=" + userId +
", firstName='" + firstName + ''' +
", lastName='" + lastName + ''' +
", email='" + email + ''' +
", phone='" + phone + ''' +
", dateOfBirth=" + dateOfBirth +
", userName='" + userName + ''' +
", password='" + password + ''' +
", authorities=" + authorities +
'}';
}
}
Security Config class for granting permissions (although I suspect something wrong in this)
@Configuration
public class SecurityConfiguration {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception{
return http
.csrf(csrf -> csrf.disable())
.authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
.build();
}
}
Service class:
@Service
public class UserService {
private final UserRepository userRepo;
private final RoleRepository roleRepo;
@Autowired
public UserService(UserRepository userRepo,RoleRepository roleRepo){
this.userRepo=userRepo;
this.roleRepo=roleRepo;
}
public ApplicationUser registerUser(ApplicationUser user){
Set<Role> roles=user.getAuthorities();
roles.add(roleRepo.findByAuthority("USER").get());
roles.add(roleRepo.findByAuthority("ADMIN").get()) ;
user.setAuthorities(roles);
return userRepo.save(user);
}
}
Controller
@RestController
@RequestMapping("/auth")
public class AuthenticationController {
private final UserService userService;
@Autowired
public AuthenticationController(UserService userService){
this.userService=userService;
}
//goes to http://localhost:8000/auth/register
@PostMapping("/register")
public ApplicationUser registerUser(@RequestBody ApplicationUser user){
userService.registerUser(user);
return user;
}
}
Idk why the postman request is being reflected in the spring boot console but not in the database. How do I make it to save the postman request to the database?
2
Answers
You are sending "text", maybe try to change it to "JSON" here:
enter image description here
403 Forbidden indicates Authentication was successful (otherwise would return 401 unauthorized) but the authenticated user does not have access to the resource, I hope it’s useful someway.