I use Spring Security, i am authorize with ADMIN_ROLE on page. I have “lock user” button on this page and when i press the button, request sends and i get 403 error. Page loads styles from file style.css. And when styles enabled i get error, when i disable styles, i don’t get error. Who can help me with it?

Html meta

<meta charset="UTF-8"> <title>Users</title> <link rel="stylesheet" type="text/css" href="/style.css">

Form with patch requset

<form th:action="@{'/users/' + ${user.userId} + '?lock=1'}" method="post"> <input type="hidden" name="_method" value="patch"> <button class="page_button" type="submit">Lock user</button> </form>

Server logs with enabled security trace

2024-05-08T16:12:13.191+04:00 TRACE 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.security.web.FilterChainProxy : Securing PATCH /users/a77246cc-3353-4480-936f-d2d6ef9a706d?lock=1

2024-05-08T16:12:13.192+04:00 DEBUG 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.security.web.csrf.CsrfFilter : Invalid CSRF token found for https://localhost:8080/users/a77246cc-3353-4480-936f-d2d6ef9a706d?lock=1

2024-05-08T16:12:13.192+04:00 DEBUG 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.s.w.access.AccessDeniedHandlerImpl : Responding with 403 status code

2024-05-08T16:12:13.192+04:00 TRACE 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.security.web.FilterChainProxy : Trying to match request against DefaultSecurityFilterChain [RequestMatcher=any request, Filters=

2024-05-08T16:12:13.192+04:00 DEBUG 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.security.web.FilterChainProxy : Securing POST /error?lock=1

2024-05-08T16:12:13.193+04:00 TRACE 103408 --- [fin-man-api] [nio-8080-exec-9] .s.s.w.c.SupplierDeferredSecurityContext : Created SecurityContextImpl [Null authentication]

2024-05-08T16:12:13.193+04:00 TRACE 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.s.w.a.AnonymousAuthenticationFilter : Set SecurityContextHolder to AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=651448C2F40E52F1E955B65F3CF7ADBC], Granted Authorities=[ROLE_ANONYMOUS]]

2024-05-08T16:12:13.193+04:00 TRACE 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.security.web.FilterChainProxy : Invoking ExceptionTranslationFilter (13/16)

2024-05-08T16:12:13.193+04:00 TRACE 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.security.web.FilterChainProxy : Invoking JwtRequestFilter (14/16)

2024-05-08T16:12:13.193+04:00 TRACE 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.security.web.FilterChainProxy : Invoking JwtRefreshFilter (15/16)

2024-05-08T16:12:13.193+04:00 TRACE 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.security.web.FilterChainProxy : Invoking AuthorizationFilter (16/16)

2024-05-08T16:12:13.193+04:00 TRACE 103408 --- [fin-man-api] [nio-8080-exec-9] estMatcherDelegatingAuthorizationManager : Authorizing SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@5168821]]

2024-05-08T16:12:13.193+04:00 TRACE 103408 --- [fin-man-api] [nio-8080-exec-9] estMatcherDelegatingAuthorizationManager : Checking authorization on SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@5168821]] using org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer$$Lambda$1886/0x0000022711c49800@7ea871b5

2024-05-08T16:12:13.193+04:00 DEBUG 103408 --- [fin-man-api] [nio-8080-exec-9] o.s.security.web.FilterChainProxy : Secured POST /error?lock=1

2024-05-08T16:12:13.203+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] o.s.security.web.FilterChainProxy : Trying to match request against DefaultSecurityFilterChain [RequestMatcher=any request, Filters=

2024-05-08T16:12:13.204+04:00 DEBUG 103408 --- [fin-man-api] [io-8080-exec-10] o.s.security.web.FilterChainProxy : Securing GET /style.css

2024-05-08T16:12:13.204+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] o.s.s.w.a.www.BasicAuthenticationFilter : Found username '[email protected]' in Basic Authorization header

2024-05-08T16:12:13.204+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] .s.s.w.c.SupplierDeferredSecurityContext : Created SecurityContextImpl [Null authentication]

2024-05-08T16:12:13.204+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] o.s.s.authentication.ProviderManager : Authenticating request with DaoAuthenticationProvider (1/1)

Hibernate: select u1_0.id,u1_0.email,u1_0.account_is_locked,u1_0.account_is_enabled,u1_0.password,u1_0.user_id from users_table u1_0 where u1_0.email=?

Hibernate: select r1_0.id,r1_1.role_id,r1_1.role_name from role_user r1_0 join roles_table r1_1 on r1_1.role_id=r1_0.role_id where r1_0.id=?

2024-05-08T16:12:13.480+04:00 DEBUG 103408 --- [fin-man-api] [io-8080-exec-10] o.s.s.a.dao.DaoAuthenticationProvider : Authenticated user

2024-05-08T16:12:13.480+04:00 DEBUG 103408 --- [fin-man-api] [io-8080-exec-10] .s.ChangeSessionIdAuthenticationStrategy : Changed session id from 651448C2F40E52F1E955B65F3CF7ADBC

2024-05-08T16:12:13.481+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] s.CompositeSessionAuthenticationStrategy : Preparing session with CsrfAuthenticationStrategy (2/2)

2024-05-08T16:12:13.481+04:00 DEBUG 103408 --- [fin-man-api] [io-8080-exec-10] o.s.s.w.csrf.CsrfAuthenticationStrategy : Replaced CSRF Token

2024-05-08T16:12:13.481+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] o.s.security.web.FilterChainProxy : Invoking ExceptionTranslationFilter (13/16)

2024-05-08T16:12:13.481+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] o.s.security.web.FilterChainProxy : Invoking JwtRequestFilter (14/16)

2024-05-08T16:12:13.481+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] o.s.security.web.FilterChainProxy : Invoking JwtRefreshFilter (15/16)

2024-05-08T16:12:13.481+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] o.s.security.web.FilterChainProxy : Invoking AuthorizationFilter (16/16)

2024-05-08T16:12:13.481+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] estMatcherDelegatingAuthorizationManager : Authorizing SecurityContextHolderAwareRequestWrapper[ org.springframework.security.web.header.HeaderWriterFilter$HeaderWriterRequest@2102ea33]

2024-05-08T16:12:13.481+04:00 TRACE 103408 --- [fin-man-api] [io-8080-exec-10] estMatcherDelegatingAuthorizationManager : Checking authorization on SecurityContextHolderAwareRequestWrapper[ org.springframework.security.web.header.HeaderWriterFilter$HeaderWriterRequest@2102ea33] using org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer$$Lambda$1886/0x0000022711c49800@7ea871bz

2024-05-08T16:12:13.481+04:00 DEBUG 103408 --- [fin-man-api] [io-8080-exec-10] o.s.security.web.FilterChainProxy : Secured GET /style.css

I tryied add “/style.css” in permitAll requests. I tryied off CSRF for “/style.css” and many another oprions, but nothing not help.