Spring security added prefix "ROLE_" to all roles name?

Question

I have this code in my Web Security Config:

 @Override protected void configure(HttpSecurity http) throws Exception {     http             .authorizeRequests()             .antMatchers("/api/**")             .hasRole("ADMIN")             .and()             .httpBasic().and().csrf().disable();  } 

So I added an user with "ADMIN" role in my database and I always get 403 error when I tryed loggin with this user, then I enabled log for spring and I found this line:

2015-10-18 23:13:24.112 DEBUG 4899 --- [nio-8080-exec-1] o.s.s.w.a.i.FilterSecurityInterceptor    : Secure object: FilterInvocation: URL: /api/user/login; Attributes: [hasRole('ROLE_ADMIN')] 

Why Spring Security is looking for "ROLE_ADMIN" instead "ADMIN"?

Answer 1

Spring security adds the prefix "ROLE_" by default.

If you want this removed or changed, take a look at

How to change role from interceptor-url?

EDIT: found this as well: Spring Security remove RoleVoter prefix