# Protected API allows GET requests through

**URL:** <https://community.auth0.com/t/protected-api-allows-get-requests-through/77470>\
**Category:** Get Help\
**Tags:** api, spring-security, auth0\
**Created:** [February 2, 2022, 10:37am UTC](https://community.auth0.com/t/protected-api-allows-get-requests-through/77470 "2022-02-02T10:37:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![samu-magaz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/samu-magaz/32/34856_2.png) [@samu-magaz](https://community.auth0.com/u/samu-magaz)\
**Post date:** [February 2, 2022, 10:37am UTC](https://community.auth0.com/t/protected-api-allows-get-requests-through/77470/1 "2022-02-02T10:37:24Z")

</div>

Hey everyone,

I’m using Auth0 for the first time for my master’s thesis. I’m developing a classic web application with frontend and backend, but I’m having some issues with the back.

I’m trying to protect the access to the back’s API through Auth0, and everything seems to work great except for the GET requests: they’re getting through somehow. I’ll leave some code/screenshots bellow to illustrate the issue.

```auto
//SecurityConfig.java
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${auth0.audience}")
    private String audience;

    @Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}")
    private String issuer;

    @Bean
    JwtDecoder jwtDecoder() {
        NimbusJwtDecoder jwtDecoder = (NimbusJwtDecoder)
                JwtDecoders.fromOidcIssuerLocation(issuer);

        OAuth2TokenValidator<Jwt> audienceValidator = new AudienceValidator(audience);
        OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuer);
        OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);

        jwtDecoder.setJwtValidator(withAudience);

        return jwtDecoder;
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .mvcMatchers("/").permitAll()
                .mvcMatchers("/user").authenticated()
                .and().oauth2ResourceServer().jwt();
    }
}

```

```auto
//AudienceValidator.java
class AudienceValidator implements OAuth2TokenValidator<Jwt> {

    private final String audience;

    AudienceValidator(String audience) {
        this.audience = audience;
    }

    public OAuth2TokenValidatorResult validate(Jwt jwt) {
        OAuth2Error error = new OAuth2Error("invalid_token", "The required audience is missing", null);

        if (jwt.getAudience().contains(audience)) {
            return OAuth2TokenValidatorResult.success();
        }
        return OAuth2TokenValidatorResult.failure(error);
    }
}

```

```auto
//UserController.java
@RestController
@RequestMapping("/user")
public class UserController {

    @Resource(name = "userServiceImpl")
    private UserServiceImpl userService;

    @GetMapping("/{id}")
    public UserDTO getUser(@PathVariable long id) {
        return userService.getUserById(id);
    }

    @PostMapping
    public UserDTO saveUser(@RequestBody UserDTO userDTO) {
        return userService.saveUser(userDTO);
    }

    @DeleteMapping("/{id}")
    public boolean deleteUser(@PathVariable long id) {
        return userService.deleteUserById(id);
    }
}

```

SaveUser without token

 ![image](https://global.discourse-cdn.com/auth0/original/3X/7/9/797c43a36dfd281d2f1ffc42474d420a4f6e4154.png)

SaveUser with token

 ![image](https://global.discourse-cdn.com/auth0/original/3X/9/d/9d928196b6f0ec09918e3eed5357facddee1d9b3.png)

GetUser without token

 ![image](https://global.discourse-cdn.com/auth0/original/3X/9/7/97f506b5e65d39c02e7ab54a7084fabba9bee1b8.png)

DeleteUser behaves exactly as SaveUser

Like I said, this is my first time using Auth0 so if there is anything I left behind don’t hesitate to ask for it. Any help is well received.

Thanks!

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [February 22, 2022, 9:53pm UTC](https://community.auth0.com/t/protected-api-allows-get-requests-through/77470/3 "2022-02-22T21:53:28Z")

</div>

Hi @samu-magaz,

Welcome to the Auth0 Community!

Sorry for the delay! I am not a Spring Security expert, but it looks like you will need an additional `mvcMatchers` property to cover the `/users/*` endpoint.

The docs for spring security [provide an example](https://docs.spring.io/spring-security/site/docs/4.2.x/apidocs/org/springframework/security/config/annotation/web/builders/HttpSecurity.html#mvcMatcher-java.lang.String-) as `/admin/**`.

Hope that helps and good luck with your thesis!

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [April 8, 2022, 4:39pm UTC](https://community.auth0.com/t/protected-api-allows-get-requests-through/77470/4 "2022-04-08T16:39:53Z")

</div>