==========================================================================
 Spring Security TRACE log: why a permitAll() endpoint answers 403
 profiles: hs256,csrfon,trace     request: POST /api/auth/login
==========================================================================

DEBUG [nio-8080-exec-2] o.s.security.web.FilterChainProxy        : Securing POST /api/auth/login
TRACE [nio-8080-exec-2] o.s.security.web.FilterChainProxy        : Invoking DisableEncodeUrlFilter (1/12)
TRACE [nio-8080-exec-2] o.s.security.web.FilterChainProxy        : Invoking WebAsyncManagerIntegrationFilter (2/12)
TRACE [nio-8080-exec-2] o.s.security.web.FilterChainProxy        : Invoking SecurityContextHolderFilter (3/12)
TRACE [nio-8080-exec-2] o.s.security.web.FilterChainProxy        : Invoking HeaderWriterFilter (4/12)
TRACE [nio-8080-exec-2] o.s.security.web.FilterChainProxy        : Invoking CsrfFilter (5/12)
TRACE [nio-8080-exec-2] s.s.w.c.CsrfTokenRequestAttributeHandler : Wrote a CSRF token to the following request attributes: [_csrf, org.springframework.security.web.csrf.CsrfToken]
TRACE [nio-8080-exec-2] o.s.s.web.csrf.CsrfTokenRequestHandler   : Did not find a CSRF token in the [X-XSRF-TOKEN] request header
TRACE [nio-8080-exec-2] o.s.s.web.csrf.CsrfTokenRequestHandler   : Did not find a CSRF token in the [_csrf] request parameter
DEBUG [nio-8080-exec-2] o.s.security.web.csrf.CsrfFilter         : Invalid CSRF token found for http://localhost:8080/api/auth/login
TRACE [nio-8080-exec-2] o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match request to [Is Secure]

The chain stops at filter 5 of 12. AuthorizationFilter - the only filter that
has ever heard of permitAll() - is number 12. It is never invoked.