How do I use auth0 and swagger together in spring boot?

Question

I am trying to use both Swagger and Auth0. Swagger alone is working fine when I'm hitting http://localhost:8080/swagger-ui . But, after configuring auth0. It is showing 403 Forbidden Error

I'm using spring boot with gradle. I've tried to antMatchers function to permit swagger and all.

public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Value(value = "${auth0.apiAudience}")
    private String apiAudience;
    @Value(value = "${auth0.issuer}")
    private String issuer;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        JwtWebSecurityConfigurer
                .forRS256(apiAudience, issuer)
                .configure(http)
                .cors().and().csrf().disable().authorizeRequests()
                .antMatchers("/v2/api-docs", "/swagger-resources/configuration/ui", "/swagger-resources", "/swagger-resources/configuration/security", "/swagger-ui.html", "/webjars/**").permitAll()
                .and()
                .authorizeRequests()    
                .anyRequest()
                .authenticated()
                .and()
                .csrf().disable();
    }
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/v2/api-docs", "/swagger-resources/configuration/ui", "/swagger-resources", "/swagger-resources/configuration/security", "/swagger-ui.html", "/webjars/**");
    }
}

Since I'm learning and new to java and spring boot. I expect http://localhost:8080/swagger-ui even without security is enough.

Answer 1

when do you encounter the 403 error? Generally in a situation like this we would commend capturing a HAR file and then we would review the flow to see where the breakdown may have been. However we need more information here to properly decide where the error is.

That being said I have attached the Auth0 quickstart for spring that may help provide some insight.

https://auth0.com/docs/quickstart/backend/java-spring-security/01-authorization