Himai Minh

Does this help:
https://stackoverflow.com/questions/74146917/spring-security-the-request-was-rejected-because-the-url-contained-a-potential  ?

Does this discussion help:
https://github.com/spring-projects/spring-security/issues/14636  ?

Also, my next test is to use  @PreAuthorize("hasAuthority('USER')") for the get endpoint instead of @RolesAllowed.
It now works.

So far, I made some changes to your code:
public class JwtTokenProvider { public String createAccessToken(long id, String username, Role role){        Claims claims = Jwts.claims().subject(username)                .add("id",id)                .add("scope","read")  //use read instead of access                .add("role",role.name())                .build();          return Jwts.builder()                .header()                .add("type","JWT")   //use type instead of typ                .and()               ....    }

import jakarta.annotation.security.RolesAllowed; @RestController @RequestMapping("/endpoints") public class EndPoints {    //use RolesAllowed instead of @PreAuthorize    @GetMapping("/user")   @RolesAllowed({"USER"})    public String ordinaryUsersOnly(){        return "Ordinary users only";    }

In application.properties, use this property instead of create-drop to recreate the table every time I start the application:
spring.jpa.hibernate.ddl-auto=validate
I use port 8080 instead of 6666
I use Postman to do the following:
1. I first send a POST request at  localhost:8080/auth/register.
I submit these info in JSON
{
       
        "firstname" : "John",
         "lastname": "Smith",
         "username" : "jsmith3",
         "password": "smith3",
         "email" : "jsmith3@gmail.com"
       
   }
2. I then send a POST request at localhost:8080/auth/login
{       "username" : "jsmith3",
         "password": "smith3"
}
I got the access token
3. I create another GET request at localhost:8080/endpoints/user
Under the Authorization panel, copy and paste the token in the Bearer Token field.
4. So far, I get access to the endpoint

Does this article help:
https://www.baeldung.com/security-none-filters-none-access-permitAll ?

Section 5 of the article says this:

Also note that, if an <http> element doesn’t specify a pattern, then by default, that maps to the universal match pattern – “/**” – so again, this element
needs to be last. If the order of the elements is not correct, the creation of the security filter chain will fail:

One more additional note to my previous post.
Can you try to create a second user , maybe called John and a password for John?
Then, you, as Obert user,  log in and log out.
Then, you log in as John. See if John can be authenticated.

As I check your CustomLogoutHandler, it simply deletes the token, which was once used by the user and no longer needed.
It should not affect the authorities of the user.
So, when you log back in, you are denied again.
Maybe, put some debuggers in the JwtAuthenticationFilter and see.

I don't understand why you need to use the refreshToken like this:
String access_token = jwtTokenProvider.createAccessToken(user_id,username,Role.valueOf(role));     String refresh_token = jwtTokenProvider.createRefreshToken(user_id).getRefresh_token();        return LoginResponse.builder()                .access_token(access_token)                .refresh_token(refresh_token)                .build();

Also, one more thing. From the above public free example, I notice the author encrypted the text password of the user:
https://github.com/springframeworkguru/ssc-brewery/blob/mtc-secure-read-beer-order/src/main/java/guru/sfg/brewery/bootstrap/DefaultBreweryLoader.java
https://github.com/springframeworkguru/ssc-brewery/blob/mtc-secure-read-beer-order/src/main/java/guru/sfg/brewery/config/SecurityConfig.java

I am not sure if you need to encrypt your raw text password before you convert it to JWT token.

Also, one more additional note to my above comment. I found a public free educational example Github https://github.com/springframeworkguru/ssc-brewery/blob/mtc-secure-read-beer-order/src/main/java/guru/sfg/brewery/security/JpaUserDetailsService.java
This example shows:

   public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {         //the findByUsername returns a User instead of UserDetails        return userRepository.findByUsername(username).orElseThrow(() -> {            return new UsernameNotFoundException("User name: " + username + " not found");        });    }

So, in your code, you can do this:
 public class OurUserDetailsService implements UserDetailsService {    private final UserRepository userRepository;    @Override    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {        User user = userRepository.findByUsername(username)                .orElseThrow(()-> new UsernameNotFoundException("OurUserDetailsService-: Username not found"));        Set<GrantedAuthority> authorities = new HashSet<>();     //return User which is a child of UserDetails anyway      return user;       //   return new org.springframework.security.core.userdetails.User(   //             user.getUsername(),       //         user.getPassword(),      //          authorities);    }

First of all, where is this error coming from : ((User)userDetails).password = Cannot find local variable 'userDetails'   ?

In the AuthService class,  can you put some debuggers in the login method  to see how it goes?
Especially inside the generateNewAccessToken method, put a debugger in this line:  UserDetails userDetails = ourUserDetailsService.loadUserByUsername(username);

Also, in the JwtAuthenticationFilter class, can you put some debuggers in this piece of code:
if(jwtTokenProvider.isTokenValid(jwtToken,userDetails)){                UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(                        userDetails,                        null,                        userDetails.getAuthorities()                );                authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));                SecurityContextHolder.getContext().setAuthentication(authenticationToken);            }        }        filterChain.doFilter(request,response);

That way, you can see if your token is valid or invalid.

The empty authority may not be the cause.
The cause is your credentials cannot be authenticated. Try to put a debugger in line 16 or 17 of JwtAuthenticationEntryPoint. Run the code in the debug mode and see if this filter is passed through.

For example, put a debugger in line 43 of your JwtAuthenticationFilter class and see.
Or, put some more debuggers in this class to trace the code.

Try to put some debuggers in your code and   run your code in debugging mode.
The problem may be from a JWT token that can't be validated .
Or, try to find a simple example online and see how it works.

Maybe, put some debuggers in your code and run it in debugging mode.
I guess what your code does is to create a JWT token for a user. When the user logins, a JWT token is generated.
See the JWT token generated for a new user. When the user submits a request , see if  the token matches with original token.
This is a good tutorial:
https://www.javainuse.com/spring/boot-jwt

You can also check if the information in your token correct by pasting your token here:
https://jwt.io/
Remember to select the right algorithm you are using in your code.

I guess the user input credentials cannot be authenticated.
401 unauthorization error means authentication failing.
Are you sure you input the right credentials?