You should also add /api/v1/forum/threads (without any slashes) to the security exceptions in the SecurityConfig and the JwtFilter, currently that configurations set as public only the paths that has a suffix.