why @WithMockUser still got 401 unauthorized

@AutoConfigureMockMvc

for none reactive spring application, the Servlet API and Servlet containers, spring-boot-starter-web, please use MockMvc.

import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
@DirtiesContext(classMode = ClassMode.AFTER_EACH_TEST_METHOD)
@AutoConfigureMockMvc
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
public class IntegrationTestsBase {
    @Autowired
    protected MockMvc mockMvc;
    ...

 mockMvc.perform(post(url)
                .header(HttpHeaders.AUTHORIZATION, "authorization")
                .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
                ...
                .content(objectMapper.writeValueAsString(req))
        ).andReturn().getResponse();

@AutoConfigureWebTestClient

for reactive spring application, The reactive-stack web framework, spring-boot-starter-webflux, please use WebTestClient.

@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@DirtiesContext(classMode = ClassMode.AFTER_EACH_TEST_METHOD)
@AutoConfigureWebTestClient(timeout = "100000")
public class IntegrationTests {
    @Autowired
    protected WebTestClient webTestClient;
    ...

webTestClient
                .get()
                .uri(uriBuilder -> 
                        .build())

                .header(Headers.LANGUAGE, "EN")
                .header(Headers.AUTHORIZATION, "authorization")
                .exchange()
                .expectStatus()
                .is2xxSuccessful()
                .expectBody(PortalContractResponse[].class)
                .returnResult().getResponseBody();

@MockWithUser

@MockWithUser is a custom annotation used in Spring Boot tests to simplify the process of mocking user authentication. This annotation is typically used in conjunction with Spring Security tests to automatically mock user authentication details, such as username, roles, and authorities, allowing for easier testing of secured endpoints and methods.

When applied to a test method or class, @MockWithUser populates the security context with a mocked user, eliminating the need for manual setup of authentication details in each test case.

By using @MockWithUser, you can streamline your Spring Security tests and focus on testing the behavior of your application without worrying about setting up user authentication details manually in each test case.

@SpringBootTest
class UserControllerIntegrationTest {


    @Test
    @MockWithUser(username = "testuser", roles = {"USER", "ADMIN"})
    void testGetUserDetails() throws Exception {
        // use MockMvc or WebTestClient
    }
}

Conclusion

In conclusion, when using the Servlet API and Servlet containers with WebTestClient, or when employing MockMvc in reactive-stack web frameworks, encountering persistent 401 unauthorized responses in test cases is a common occurrence. This behavior arises due to the inherent differences in how authentication is handled between these components. As such, developers need to be aware of these nuances and adapt their testing strategies accordingly. Strategies such as configuring authentication mechanisms appropriately for the chosen testing framework or utilizing custom authentication mechanisms can help mitigate these challenges and ensure successful test execution.