Using postman, I can get a list of users with a get request to: http://localhost:8080/users
.
But when I send a post request to the same address, I get a 40
403 means you don't have authorization. Even though you commented out your method, your code will still be preconfigured with default security access.
You can add:
http.authorizeRequests()
.antMatchers("/users/**").permitAll();
UPDATE : The configuration with csrf disabled:
http.csrf()
.ignoringAntMatchers("/users/**")
.and()
.authorizeRequests()
.antMatchers("/users/**").permitAll();