In a unit test, we want to focus on the behavior of the controller. We do not want to test security in our unit tests.

The following code snippet shows how we can disable security for the unit test:

@RunWith(SpringRunner.class)
@WebMvcTest(value = TodoController.class, secure = false)
public class TodoControllerTest {

The key part is the secure = false parameter on the WebMvcTest annotation. This will disable Spring Security for the unit test.

Similar changes need to be performed on all other unit test classes, including BasicControllerTest.