Debug Past an HTTP 403 Without Breaking Spring Security - The JetBrains Blog

IntelliJ IDEA Ultimate 2026.2 introduces Spring Security inlays through its Spring Debugger plugin to help developers inspect effective HTTP authorization requirements and temporarily bypass them during an active debug session without editing configuration or restarting an application. The inlays display runtime role or authority rules derived from the live SecurityFilterChain, link to relevant configuration, and can unlock a precise URI and HTTP method either with its required roles or with custom credentials and authorities. Unlocking injects a temporary TestingAuthenticationToken into Spring Security’s context at AuthorizationFilter, allowing normal downstream authorization evaluation while preserving protections such as CSRF checks; however, it affects every client reaching the unlocked endpoint and should be used cautiously, particularly on network-accessible or remote applications. The feature is limited to Servlet-based Spring Security authorization, requires an active debugger, does not support WebFlux or legacy FilterSecurityInterceptor configurations, and may not work with custom principal types or @AuthenticationPrincipal parameters. Method-level security is not directly unlocked but can pass when the injected authorities satisfy its checks, while planned future MCP support may enable automated workflows to inspect and unlock endpoints programmatically.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.