---
title: "Debug Past an HTTP 403 Without Breaking Spring Security"
description: "Spring Security can reject a request before execution reaches a controller breakpoint, leaving developers to determine the effective roles and whether bypassing authorization is safe for debugging. IntelliJ IDEA’s security inlays read the live SecurityFilterChain during an active debug session, show role or authority requirements, link to configuration, and let developers unlock an exact URI and HTTP method either with all listed roles or with a chosen username and authority set. The debugger populates an artificial Authentication in the running application’s SecurityContext without changing configuration, while CSRF checks and method-level authorization still apply separately. Unlocks last for the debug session or until relocked, affect every client reaching that route, and have limitations including Servlet-only support, no programmatic API, and a null @AuthenticationPrincipal result."
---

# Debug Past an HTTP 403 Without Breaking Spring Security

[Jetbrains](https://yomu.fyi/company/jetbrains) · Andrey Belyaev · Sep 8, 2026

**Type:** Explainer

## Summary

Spring Security can reject a request before execution reaches a controller breakpoint, leaving developers to determine the effective roles and whether bypassing authorization is safe for debugging. IntelliJ IDEA’s security inlays read the live SecurityFilterChain during an active debug session, show role or authority requirements, link to configuration, and let developers unlock an exact URI and HTTP method either with all listed roles or with a chosen username and authority set. The debugger populates an artificial Authentication in the running application’s SecurityContext without changing configuration, while CSRF checks and method-level authorization still apply separately. Unlocks last for the debug session or until relocked, affect every client reaching that route, and have limitations including Servlet-only support, no programmatic API, and a null @AuthenticationPrincipal result.

## Context

A secured request may return 403, 401, or a login redirect before reaching a Spring MVC controller or service breakpoint. Developers need to inspect the effective authorization rules and debug protected logic without temporarily editing SecurityConfig or changing the application’s authentication setup.

## Approach / What changed

IntelliJ IDEA security inlays inspect the live Spring Security SecurityFilterChain during an active debug session and expose endpoint requirements. An unlock action adds a URI, username, and authorities to the debug session; a non-suspending breakpoint at AuthorizationFilter then populates an artificial Authentication in the running application’s SecurityContext.

## Takeaways

- Unlocking applies to the exact URI and HTTP method, or to all matching path values when performed on a controller mapping, and affects every client that can reach the running application.
- Unlocking does not bypass CSRF or directly disable method security; checks such as @PreAuthorize are evaluated separately using the SecurityContext populated by the debugger.
- The feature requires IntelliJ IDEA Ultimate’s Spring Debugger plugin, an active local or remote debug session, and the Servlet stack; it is not supported for WebFlux and has no programmatic switch in 2026.2.

**Tags:** [Debugging](https://yomu.fyi/topic/debugging), [Java](https://yomu.fyi/topic/java), [Spring Security](https://yomu.fyi/topic/spring-security)

- Source: [Jetbrains](https://blog.jetbrains.com/idea/2026/09/debug-past-an-http-403-without-breaking-spring-security)
- Source URL: https://blog.jetbrains.com/idea/2026/09/debug-past-an-http-403-without-breaking-spring-security
- Ingested by Yomu: 2026-09-08T16:01:00.046Z

[Read original post](https://blog.jetbrains.com/idea/2026/09/debug-past-an-http-403-without-breaking-spring-security)