Spring Security: hasRole adds the ROLE_ prefix, hasAuthority does not

The single most common cause of an unexpected 403.

Code
// Authority stored on the user: "ROLE_ADMIN"
.requestMatchers("/admin/**").hasRole("ADMIN")        // matches - prefix added
.requestMatchers("/admin/**").hasAuthority("ADMIN")   // does NOT match
.requestMatchers("/admin/**").hasAuthority("ROLE_ADMIN") // matches
Output
hasRole("ADMIN")        -> checks for ROLE_ADMIN
hasAuthority("ADMIN")   -> checks for ADMIN literally -> 403
Advertisement

Run this yourself in the Online Java Compiler, spin up a live REST API in the API Sandbox, or practise with Java interview questions.

Published 2026-08-11