Cannot access jsf page when using spring security, 403 occurs

When I am using jsf with spring boot there is no problem to access the jsf bean, but when I add spring security I get access denied 403 when trying to access pages using jsf bean function, I can only access the pages with the url. I've been searching a lot to solve this issue but nothing did work, please if someone can help me solve this issue.

here is my code:

jsf BeanProduit.java

@ManagedBean @Component @SessionScoped public class BeanProduit { @Autowired @Qualifier("produitsPrixServiceImpl") private CrudService<ProduitsPrix> produitsPrixService; @Autowired @Qualifier("produitsStockServiceImpl") private CrudService<ProduitsStock> produitsStockService; private List<ProduitsStock> produits; private Logger logger = Logger.getLogger(getClass().getName()); public BeanProduit() { produits = new ArrayList<ProduitsStock>(); } @PostConstruct public void init() { produits = getListProductsFinal(); } public String loadProduct(int codePdt) { logger.info("loading product: " + codePdt); try { // get product from database ProduitsPrix product = produitsPrixService.findById(codePdt); // put in the request attribute ... so we can use it on the form page ExternalContext externalContext = FacesContext.getCurrentInstance().getExternalContext(); Map<String, Object> requestMap = externalContext.getRequestMap(); requestMap.put("product", product); } catch (Exception exc) { // send this to server logs logger.log(Level.SEVERE, "Error loading product id:" + codePdt, exc); // add error message for JSF page addErrorMessage(exc); return null; } return "/pages/form-validation"; } } 

config file of spring security DemoSecurityConfig.java

@EnableWebSecurity public class DemoSecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private DataSource securityDataSource; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.jdbcAuthentication().dataSource(securityDataSource); } @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .antMatchers("/assets/**") .permitAll() .antMatchers("/authentication/login.xhtml?logout").hasAnyRole("EMPLOYEE") .antMatchers("/**").hasRole("ADMIN") .and().formLogin().loginPage("/authentication/login.xhtml") .loginProcessingUrl("/authenticateTheUser").permitAll() .defaultSuccessUrl("/", true) .and().logout().permitAll() .and().exceptionHandling().accessDeniedPage("/error/error-403.xhtml"); } } 

snippet code from the view

<h:form> <ui:repeat value="#{beanProduit.produits}" var="produit"> <tr> <td>#{produit.codePdt}</td> <td>#{produit.nomPdt}</td> <td>#{produit.prixPdt}</td> <td>#{produit.qtePdt}</td> <td class="text-center"> <h:commandButton class="btn btn-primary" value="Acheter" action="#{beanProduit.loadProduct(produit.codePdt)}" /> </td> </tr> </ui:repeat> </h:form>