I have added a Custom filter to retrieve and validate the firebase jwt token in my request. I’m trying to test an unauthorized endpoint which is /api/v1/order/hi, but unfortunately for me, I get a 403 Unauthorized even tho the endpoint is “permitall” and I get a 403 on every endpoint. I tried commenting out the addFilterBefore line in my Security config, but I still get the same result. It seems the issue isn’t with the filter? I disabled csrf and all.

My security config:

@Configuration
@EnableWebSecurity
class SecurityConfig(val firebaseTokenFilter: FirebaseTokenFilter) {
    @Bean
    fun configure(http: HttpSecurity): SecurityFilterChain {
        return http
            .csrf { it.disable() }
            .authorizeHttpRequests { auth ->
                auth
                    .requestMatchers("/api/v*/auth/**", "/api/v*/order/**").permitAll()
                    .anyRequest().authenticated()
            }
            .sessionManagement { sess -> sess.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
            .addFilterBefore(firebaseTokenFilter, UsernamePasswordAuthenticationFilter::class.java)
            .build()
    }
}

My token filter:

class FirebaseTokenFilter : OncePerRequestFilter() {

    override fun doFilterInternal(
        request: HttpServletRequest,
        response: HttpServletResponse,
        filterChain: FilterChain
    ) {
        val token = getTokenFromRequest(request)

        if (token != null) {
            try {
                val decodedToken: FirebaseToken = FirebaseAuth.getInstance().verifyIdToken(token)
                val user = User(decodedToken.uid, "", listOf(SimpleGrantedAuthority("ROLE_USER")))
                val authentication = UsernamePasswordAuthenticationToken(user, null, user.authorities)
                authentication.details = WebAuthenticationDetailsSource().buildDetails(request)
                SecurityContextHolder.getContext().authentication = authentication
            } catch (e: Exception) {
                // Token verification failed
            }
        }

        filterChain.doFilter(request, response)
    }

private fun getTokenFromRequest(request: HttpServletRequest): String? {
    val bearerToken = request.getHeader("Authorization")
    return if (bearerToken != null && bearerToken.startsWith("Bearer ")) {
        bearerToken.substring(7)
    } else null
}

}