我创建了Web应用程序。pom.xml

<dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-security</artifactId>
     <version>3.1.4</version>
 </dependency>
https://mvnrepository.com/artifact/org.yaml/snakeyaml -->
 <dependency>
     <groupId>org.yaml</groupId>
     <artifactId>snakeyaml</artifactId>
     <version>2.0</version>
 </dependency>

https://mvnrepository.com/artifact/org.springframework.security/spring-security-config -->
 <dependency>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-config</artifactId>
     <version>6.1.4</version>
 </dependency>

文件控制器

@RequestMapping("/passports")
@RequiredArgsConstructor
public class PassportController {

    @Operation(
description = "Удаление паспорта из таблицы",
summary = "delete passport",
hidden = false
    )
    @ApiResponse(responseCode = "200", description = "PassportResponse")
    @DeleteMapping("/{id}")
public void deleteById(
            @PathVariable(name = "id") final long id
throws Exception {
passportComponent.deleteById(id);
    }
}

文件WebSecurityConfigurer

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class WebSecurityConfigurer {

    @Bean
public InMemoryUserDetailsManager userDetailsService() {
UserDetails user = User.withUsername("user")
                .password(encoder().encode("userPass"))
                .roles("USER")
                .build();
return new InMemoryUserDetailsManager(user);
    }

    @Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

XorCsrfTokenRequestAttributeHandler requestHandler = new XorCsrfTokenRequestAttributeHandler();

requestHandler.setCsrfRequestAttributeName(null);

http
            .cors(Customizer.withDefaults())
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests((authz) -> authz
                .requestMatchers(HttpMethod.GET).permitAll()
                .requestMatchers(HttpMethod.DELETE).permitAll()
                .anyRequest().authenticated()
             )
            .csrf((csrf) -> csrf
                .csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler())
            )
            .csrf((csrf) -> csrf
                .csrfTokenRequestHandler(requestHandler)
            )
            .csrf((csrf) -> csrf
                .csrfTokenRepository(new HttpSessionCsrfTokenRepository())
            )
            .csrf((csrf) -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            )
            .csrf((csrf) -> csrf
                .csrfTokenRequestHandler(new XorCsrfTokenRequestAttributeHandler())
            )
            .csrf((csrf) -> csrf
                .ignoringRequestMatchers("/no-csrf"))
            .csrf(Customizer.withDefaults()).csrf((csrf) -> csrf
                .csrfTokenRepository(new HttpSessionCsrfTokenRepository()))
            .csrf((csrf) -> csrf
                .csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler())
            );
return http.build();
    }

    @Bean
public InMemoryUserDetailsManager inMemoryUserDetailsManager(){
List<UserDetails> userDetailsList = new ArrayList<>();
userDetailsList.add(User.withUsername("user").password(encoder().encode("userPass"))
                .roles("EMPLOYEE", "USER").build());
return new InMemoryUserDetailsManager(userDetailsList);
    }
    @Bean
public PasswordEncoder encoder() {
return new BCryptPasswordEncoder();
    }
}

@GetMapping（）是OK我尝试使用删除方法在 Postman 。但是我收到的答案是"status": 403,"error": "Forbidden" .我做错了什么？我该怎么解决这个问题？