How do I remove the ROLE_ prefix from Spring Security with JavaConfig?
<p>I'm trying to remove the "ROLE_" prefix in Spring Security. The first thing I tried was:</p>

<pre><code>http.servletApi().rolePrefix("");
</code></pre>

<p>That didn't work, so I tried creating a <code>BeanPostProcessor</code> as suggested in <a href="http://docs.spring.io/spring-security/site/migrate/current/3-to-4/html5/migrate-3-to-4-jc.html#m3to4-role-prefixing-disable" rel="noreferrer">http://docs.spring.io/spring-security/site/migrate/current/3-to-4/html5/migrate-3-to-4-jc.html#m3to4-role-prefixing-disable</a>. That didn't work either.</p>

<p>Finally, I tried creating my own <code>SecurityExpressionHandler</code>:</p>

<pre><code>  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
          .authorizeRequests()
          .expressionHandler(webExpressionHandler())
          .antMatchers("/restricted").fullyAuthenticated()
          .antMatchers("/foo").hasRole("mycustomrolename")
          .antMatchers("/**").permitAll();
  }

  private SecurityExpressionHandler&lt;FilterInvocation&gt; webExpressionHandler() {
      DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();
      defaultWebSecurityExpressionHandler.setDefaultRolePrefix("");
      return defaultWebSecurityExpressionHandler;
  }
</code></pre>

<p>However, this doesn't work either. If I use "hasAuthority(roleName)" instead of <code>hasRole</code>, it works as expected.</p>

<p>Is it possible to remove the ROLE_ prefix from Spring Security's hasRole check?</p>