mvcMatchers().hasAuthority() denies an access even when a user has an authority

[php-coder]

Summary

.mvcMatchers("/collection/{slug}/estimation").hasAuthority("ADD_SERIES_PRICE") should always give an access to a user with ADD_SERIES_PRICE authority.

But I see that the user has access to one page and doesn't have to another:

URL	have access?
/collection/admin/estimation	Yes
/collection/paid/estimation	No

Actual Behavior

User with permission doesn't have access to a page whilst this page matches the pattern.

Expected Behavior

User with permission should have access to a page that matches the pattern.

Note that the behavior is correct when URL-pattern in the rule doesn't have path variables. For instance:
.mvcMatchers("/collection/estimation").hasAuthority("ADD_SERIES_PRICE")
works as expected.

Configuration

See https://github.com/php-coder/mystamps/blob/bc3fe55ea8748c0231f45e6f403419e6b0a02df8/src/main/java/ru/mystamps/web/support/spring/security/SecurityConfig.java#L71-L132

Version

• Spring Security 4.2.12.RELEASE
• Spring Framework 4.3.24.RELEASE
• Spring Boot 1.5.21.RELEASE

Sample

http
  .authorizeRequests()
    .mvcMatchers("/collection/{slug}/estimation").hasAuthority("ADD_SERIES_PRICE")

Steps to reproduce

• clone the repo

$ git clone https://github.com/php-coder/mystamps
$ cd mystamps
$ git checkout bc3fe55ea8748c0231f45e6f403419e6b0a02df8
$ mvn spring-boot:run

• open http://localhost:8080
• login as user "admin" with password "test" (similarly you can login as "paid" user with password "test")
• open page http://localhost:8080/collection/admin/estimation (accessible)
• open another page http://localhost:8080/collection/paid/estimation (should be accessible but it gives 403 error instead)

[fhanik]

I've simplified the code down to only have the actual matcher we're talking about present.

https://github.com/fhanik/spring-security-community/tree/master/samples/spring-sec-iss-6948

I'm unable to reproduce the issue. I also did downgrade to your versions of Spring Boot and Spring Security

Can you take a look at my sample and see if you can reproduce the behavior?

[fhanik]

I debugged your code, and found that this expression is being invoked.

And that is used by a @PreAuthorize that is invoked from here

Please reopen if you still believe it's a bug.

[php-coder]

@fhanik Thank you, Filip, for debugging the code!!

I'm so sorry that you had to do it and I missed the bug in my own code :( I've totally forgot about this check.