[geowebcache-users] 403 with GWC 2.0

[Troels A. <tr...@ar...>]

Hello,

I've started setting up my first GWC 2 installation, using a WAR file 
installation into the Tomcat 11 which ships with Debian 13.

However, I get a 403 error when accessing 
http://servername:8080/geowebcache/ :

HTTP Status 403 ? Forbidden
Description The server understood the request but refuses to authorize it.

For now, the installation is internal and not adjusted at all, so I'm 
logging in as user "geowebcache" with password "secured".

I've never seen the same with previous GeoWebCache installations.

In Tomcat's access log, the following is seen:

10.x.x.x - - [07/Jul/2026:14:58:21 +0200] "GET /geowebcache/ HTTP/1.1" 
403 659
10.x.x.x - - [07/Jul/2026:14:58:21 +0200] "GET /favicon.ico HTTP/1.1" 
404 772
127.0.0.1 - - [07/Jul/2026:14:59:54 +0200] "POST /jolokia/ HTTP/1.1" 200 779

(The jolokia line is included just to show that there's another web 
application on the Tomcat which is not rejecting access.)

When putting Tomcat in debug logging mode, the following is seen in 
catalina.out after I've entered the correct credentials:

[2026-07-07 14:58:21] [info] 14:58:21 (http-nio-8080-exec-6) DEBUG  
[web.FilterChainProxy] - Securing GET /
[2026-07-07 14:58:21] [info] 14:58:21 (http-nio-8080-exec-6) DEBUG  
[dao.DaoAuthenticationProvider] - Authenticated user
[2026-07-07 14:58:21] [info] 14:58:21 (http-nio-8080-exec-6) DEBUG  
[www.BasicAuthenticationFilter] - Set SecurityContextHolder to 
UsernamePasswordAuthenticationToken 
[Principal=org.springframework.security.core.userdetails.User 
[Username=geowebcache, Password=[PROTECTED], Enabled=true, 
AccountNonExpired=true, CredentialsNonExpired=true, 
AccountNonLocked=true, Granted Authorities=[ROLE_ADMINISTRATOR]], 
Credentials=[PROTECTED], Authenticated=true, 
Details=WebAuthenticationDetails [RemoteIpAddress=10.x.x.x, 
SessionId=BB8B730EC1AE7A4B99BC6CDBBB76E8B8], Granted 
Authorities=[ROLE_ADMINISTRATOR, FactorGrantedAuthority 
[authority=FACTOR_PASSWORD, issuedAt=2026-07-07T12:58:21.628297750Z]]]
[2026-07-07 14:58:21] [info] 14:58:21 (http-nio-8080-exec-6) DEBUG  
[access.AccessDeniedHandlerImpl] - Responding with 403 status code

What could be wrong with GeoWebCache? Has something changed between GWC 
1 and 2 regarding access restrictions?

-- 
Regards,
Troels Arvin