Failed to evaluate expression with spring security

Question

I have a Spring rest service, and I'm trying to add security to it. I followed this tutorial, but when I try to access the service directly I get the following error:

There was an unexpected error (type=Internal Server Error, status=500). Failed to evaluate expression 'ROLE_USER'

Here's my security configuration:

webSecurityConfig.xml

<http entry-point-ref="restAuthenticationEntryPoint">
      <intercept-url pattern="/**" access="ROLE_USER"/>

      <form-login
         authentication-success-handler-ref="mySuccessHandler"
         authentication-failure-handler-ref="myFailureHandler"
      />

      <logout />
   </http>

   <beans:bean id="mySuccessHandler"
      class="com.eficid.cloud.security.rest.AuthenticationSuccessHandler"/>
   <beans:bean id="myFailureHandler" class=
     "org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"/>


      <authentication-manager>
        <authentication-provider>
          <user-service>
            <user name="temp" password="temp" authorities="ROLE_USER" />
          </user-service>
        </authentication-provider>
      </authentication-manager> 

SpringSecurityConfig:

public class SpringSecurityConfig {

    public SpringSecurityConfig() {
        super();
    }

}

I'm also getting this error when trying to use curl to log in:

{
"timestamp":1460399841286,
"status":403,"error":"Forbidden",
"message":"Could not verify the provided CSRF token because your session was not found.",
"path":"/spring-security-rest/login"
}

Do I need to add the csrf token manually to the command? The service has a self-signed certificate, if that makes any difference.

Answer 1

You need hasRole('ROLE_USER') in the intercept-url element.

<intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>

See the docs for the other expressions, that you can use.