# Using Authorization with Spring Boot 3.0.2

**URL:** <https://community.auth0.com/t/using-authorization-with-spring-boot-3-0-2/133979>\
**Category:** Dev to Dev Hub\
**Tags:** sdks-quickstarts, auth0-java\
**Created:** [May 13, 2024, 1:05pm UTC](https://community.auth0.com/t/using-authorization-with-spring-boot-3-0-2/133979 "2024-05-13T13:05:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![joshua.s](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@joshua.s](https://community.auth0.com/u/joshua.s)\
**Post date:** [May 13, 2024, 1:05pm UTC](https://community.auth0.com/t/using-authorization-with-spring-boot-3-0-2/133979/1 "2024-05-13T13:05:30Z")

</div>

I have a Spring Boot application with java 17, okta-starter and thymleaf running. My Problem is now to secure some parts of the website with scopes, like in this [quick-start](https://auth0.com/docs/quickstart/backend/java-spring-security5/01-authorization). I have added my audience in the `application.yml` but I only get 403 not authorized on the specific URL.

SecurityConfiguration:

```java
@Configuration
@EnableMethodSecurity
@EnableWebSecurity
@Order(1)
public class SecurityController {

    @Value("${okta.oauth2.issuer}")
    private String issuer;
    @Value("${okta.oauth2.client-id}")
    private String clientId;

    @Bean
    public SecurityFilterChain configure(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(authorize -> authorize
                        .requestMatchers("/api/ws").permitAll()
                        .requestMatchers(HttpMethod.GET,"/api/public/**").permitAll()
                        .requestMatchers(HttpMethod.POST,"/api/public/**").permitAll()
                        .requestMatchers("/test/blank").hasAuthority("SCOPE_access:devtest")
                        .anyRequest().authenticated()

                )
                .logout(logout -> {
                    logout.addLogoutHandler(logoutHandler());
                    logout.logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
                })
                .cors().and()
                .oauth2ResourceServer((oauth2) ->
                        oauth2.jwt(withDefaults()));

        return http.build();
    }

```

application.yml:

```yml
# src/main/resources/application.yml
okta:
  oauth2:
    issuer: https://issuer.com
    client-id: longclientid
    client-secret: longclientsecret
    audience: https://api.customdomain.com/v1/api

server:
  port: 8080
  error:
    whitelabel:
      enabled: false

spring:
  messages:
    basename:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: longclientid
            client-secret: longclientsecret
            scope: openid, profile, email
      resourceserver:
        jwt:
          issuer-uri: https://issuer.com
          audiences: https://api.customdomain.com/v1/api

```

---

<div class="post-metadata">

**Author:** ![sn96gunathilaka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sn96gunathilaka/32/61829_2.png) [@sn96gunathilaka](https://community.auth0.com/u/sn96gunathilaka)\
**Post date:** [December 7, 2024, 7:27am UTC](https://community.auth0.com/t/using-authorization-with-spring-boot-3-0-2/133979/2 "2024-12-07T07:27:06Z")

</div>

Hello, have you got the solution for this

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [March 10, 2025, 8:16pm UTC](https://community.auth0.com/t/using-authorization-with-spring-boot-3-0-2/133979/4 "2025-03-10T20:16:41Z")

</div>

Hi @joshua.s

Welcome to the Auth0 Community!

I am sorry about the delayed response to your post!

I would recommend to check the access token passed to the application in order to examine if the `audience` and `scopes` claims contain the actual permissions to access your application.

If you have found a solution yourself or have any other questions, feel free to leave a reply or post again on the community!

Kind Regards,  
Nik

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 24, 2025, 8:16pm UTC](https://community.auth0.com/t/using-authorization-with-spring-boot-3-0-2/133979/5 "2025-03-24T20:16:58Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![remus.ivan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/remus.ivan/32/68771_2.png) [@remus.ivan](https://community.auth0.com/u/remus.ivan)\
**Post date:** [September 5, 2025, 8:36pm UTC](https://community.auth0.com/t/using-authorization-with-spring-boot-3-0-2/133979/6 "2025-09-05T20:36:40Z")

</div>