disabling spring security in spring boot app

Question

I have a spring boot web app with spring security configured  I want to disable authentication for a while  until needed    I add this to the application properties    security basic enable  false    management security enabled  false     Here is some part of my   But I still have a basic security included   There is a default security password generated at startup and I am still getting HTTP Authentication prompt box    My pom xml     lt project xmlns  http   maven apache org POM 4 0 0  xmlns xsi  http   www w3 org 2001 XMLSchema-instance      xsi schemaLocation  http   maven apache org POM 4 0 0 http   maven apache org xsd maven-4 0 0 xsd  gt       lt modelVersion gt 4 0 0 lt  modelVersion gt       lt groupId gt fr test sample lt  groupId gt       lt artifactId gt navigo lt  artifactId gt       lt version gt 1 0 0-SNAPSHOT lt  version gt        lt  -- Inherit defaults from Spring Boot -- gt       lt parent gt           lt groupId gt org springframework boot lt  groupId gt           lt artifactId gt spring-boot-starter-parent lt  artifactId gt           lt version gt 1 3 1 RELEASE lt  version gt       lt  parent gt        lt properties gt           lt java version gt 1 7 lt  java version gt           lt jsoup version gt 1 8 3 lt  jsoup version gt           lt guava version gt 18 0 lt  guava version gt           lt postgresql version gt 9 3-1103-jdbc41 lt  postgresql version gt       lt  properties gt        lt  -- Add typical dependencies for a web application -- gt       lt dependencies gt           lt dependency gt               lt groupId gt org springframework boot lt  groupId gt               lt artifactId gt spring-boot-starter-web lt  artifactId gt           lt  dependency gt           lt dependency gt               lt groupId gt org springframework boot lt  groupId gt               lt artifactId gt spring-boot-starter-actuator lt  artifactId gt           lt  dependency gt           lt dependency gt               lt groupId gt org springframework boot lt  groupId gt               lt artifactId gt spring-boot-starter-thymeleaf lt  artifactId gt           lt  dependency gt           lt dependency gt               lt groupId gt org springframework boot lt  groupId gt               lt artifactId gt spring-boot-starter-mail lt  artifactId gt           lt  dependency gt           lt dependency gt               lt groupId gt org springframework lt  groupId gt               lt artifactId gt spring-context-support lt  artifactId gt           lt  dependency gt           lt dependency gt               lt groupId gt org apache velocity lt  groupId gt               lt artifactId gt velocity lt  artifactId gt           lt  dependency gt           lt dependency gt               lt groupId gt org springframework boot lt  groupId gt               lt artifactId gt spring-boot-devtools lt  artifactId gt               lt optional gt true lt  optional gt           lt  dependency gt           lt dependency gt               lt groupId gt org jsoup lt  groupId gt               lt artifactId gt jsoup lt  artifactId gt               lt version gt   jsoup version  lt  version gt           lt  dependency gt           lt dependency gt               lt groupId gt com google guava lt  groupId gt               lt artifactId gt guava lt  artifactId gt               lt version gt   guava version  lt  version gt           lt  dependency gt           lt dependency gt               lt groupId gt org springframework boot lt  groupId gt               lt artifactId gt spring-boot-starter-security lt  artifactId gt           lt  dependency gt           lt dependency gt               lt groupId gt org springframework boot lt  groupId gt               lt artifactId gt spring-boot-starter-data-jpa lt  artifactId gt           lt  dependency gt           lt dependency gt               lt groupId gt org postgresql lt  groupId gt               lt artifactId gt postgresql lt  artifactId gt               lt  dependency gt       lt  dependencies gt        lt  -- Package as an executable jar -- gt       lt build gt           lt plugins gt               lt plugin gt                   lt groupId gt org springframework boot lt  groupId gt                   lt artifactId gt spring-boot-maven-plugin lt  artifactId gt               lt  plugin gt           lt  plugins gt       lt  build gt        lt  -- Add Spring repositories -- gt       lt  --  you don t need this if you are using a  RELEASE version  -- gt       lt repositories gt           lt repository gt               lt id gt spring-snapshots lt  id gt               lt url gt http   repo spring io snapshot lt  url gt               lt snapshots gt                   lt enabled gt true lt  enabled gt               lt  snapshots gt           lt  repository gt           lt repository gt               lt id gt spring-milestones lt  id gt               lt url gt http   repo spring io milestone lt  url gt           lt  repository gt       lt  repositories gt       lt pluginRepositories gt           lt pluginRepository gt               lt id gt spring-snapshots lt  id gt               lt url gt http   repo spring io snapshot lt  url gt           lt  pluginRepository gt           lt pluginRepository gt               lt id gt spring-milestones lt  id gt               lt url gt http   repo spring io milestone lt  url gt           lt  pluginRepository gt       lt  pluginRepositories gt    lt  project gt    The security is configured in WebSecurityConfig java  I have commented the annotation to disable it        Configuration    EnableWebSecurity    EnableGlobalMethodSecurity prePostEnabled   true     Order SecurityProperties ACCESS OVERRIDE ORDER  public class WebSecurityConfig extends WebSecurityConfigurerAdapter        Autowired     UserDetailsService userDetailsService        Autowired     UserService userService        Autowired     private DataSource datasource        Override     protected void configure HttpSecurity http  throws Exception              http authorizeRequests   antMatchers   bus topologie     home              http authorizeRequests   anyRequest   authenticated               antMatchers   admin      access  hasRole  ADMIN     and               formLogin   failureUrl   login error               defaultSuccessUrl   bus topologie   loginPage   login               permitAll   and   logout               logoutRequestMatcher new AntPathRequestMatcher   logout                logoutSuccessUrl   login   permitAll   and   rememberMe               rememberMeParameter  remember-me               tokenRepository persistentTokenRepository                tokenValiditySeconds 86400  and   csrf                Bean     public PersistentTokenRepository persistentTokenRepository             JdbcTokenRepositoryImpl tokenRepositoryImpl   new JdbcTokenRepositoryImpl            tokenRepositoryImpl setDataSource datasource           return tokenRepositoryImpl              Override     protected void configure AuthenticationManagerBuilder auth              throws Exception            PasswordEncoder encoder   new BCryptPasswordEncoder             auth userDetailsService userDetailsService  passwordEncoder encoder           auth jdbcAuthentication   dataSource datasource            if   userService userExists  user                  User userAdmin   new User  user   encoder encode  password    true               Set lt Authorities gt  authorities   new HashSet lt Authorities gt                 authorities add new Authorities userAdmin  ADMIN                 authorities add new Authorities userAdmin  CRIP                 authorities add new Authorities userAdmin  USER                 userAdmin setAuthorities authorities                userService createUser userAdmin

User · Accepted Answer

Use security ignored property   security ignored       security basic enable  false will just disable some part of the security auto-configurations but your WebSecurityConfig still will be registered      There is a default security password generated at startup   Try to Autowired the AuthenticationManagerBuilder    Override  Autowired protected void configure AuthenticationManagerBuilder auth  throws Exception

User · Answer

This was the only thing that worked for me  I added the following annotation to my Application class and exclude SecurityAutoConfiguration  import org springframework boot autoconfigure EnableAutoConfiguration  import org springframework boot autoconfigure security servlet SecurityAutoConfiguration    EnableAutoConfiguration exclude             SecurityAutoConfiguration class

User · Answer

Just add the following line to disable spring auto configuration in application properties file  spring autoconfigure exclude org springframework boot autoconfigure security servlet SecurityAutoConfiguration  it works on spring 2 0 5

User · Answer

For me only excluding the following classes worked  import org springframework boot actuate autoconfigure security servlet ManagementWebSecurityAutoConfiguration  import org springframework boot autoconfigure SpringBootApplication  import org springframework boot autoconfigure security servlet SecurityAutoConfiguration    SpringBootApplication exclude    SecurityAutoConfiguration class  ManagementWebSecurityAutoConfiguration class

User · Answer

Change WebSecurityConfig java  comment out everything in the configure method and add http authenticateRequest   antMatcher  quot     quot   permitAll      This will allow any request to hit every URL without any authentication

User · Answer

I think you must also remove security auto config from your  SpringBootApplication annotated class    EnableAutoConfiguration exclude         org springframework boot autoconfigure security SecurityAutoConfiguration class      org springframework boot actuate autoconfigure ManagementSecurityAutoConfiguration class

User · Answer

The accepted answer didn t work for me   If you have a multi configuration  adding the following to your WebSecurityConfig class worked for me  ensure that your Order 1  is lower than all of your other Order annotations in the class       UNCOMMENT TO DISABLE SPRING SECURITY           Configuration      Order 1      public static class DisableSecurityConfigurationAdapater extends WebSecurityConfigurerAdapter            Override         protected void configure HttpSecurity http  throws Exception               http antMatcher        authorizeRequests   anyRequest   permitAll

User · Answer

just add   SpringBootApplication exclude   SecurityAutoConfiguration class

User · Answer

With this solution you can fully enable disable the security by activating a specific profile by command line  I defined the profile in a file application-nosecurity yaml  spring    autoconfigure      exclude  org springframework boot autoconfigure security servlet SecurityAutoConfiguration   Then I modified my custom WebSecurityConfigurerAdapter by adding the  Profile   nosecurity   as follows    Configuration  EnableWebSecurity  EnableGlobalMethodSecurity prePostEnabled   true  securedEnabled   true   Profile   nosecurity   public class WebSecurityConfig extends WebSecurityConfigurerAdapter         To fully disable the security it s enough to start the application up by specifying the nosecurity profile  i e    java -jar  target myApp jar --spring profiles active nosecurity

User · Answer

security ignored is deprecated since Spring Boot 2   For me simply extend the Annotation of your Application class did the Trick    SpringBootApplication exclude   SecurityAutoConfiguration class

User · Answer

Try this  Make a new class   Configuration public class SecurityConfiguration extends WebSecurityConfigurerAdapter         Override     protected void configure HttpSecurity httpSecurity  throws Exception           httpSecurity authorizeRequests   antMatchers      permitAll           Basically this tells Spring to allow access to every url   Configuration tells spring it s a configuration class

User · Answer

You could just comment the maven dependency for a while    lt dependencies gt           lt dependency gt               lt groupId gt org springframework boot lt  groupId gt               lt artifactId gt spring-boot-starter-actuator lt  artifactId gt           lt  dependency gt           lt dependency gt               lt groupId gt org springframework boot lt  groupId gt               lt artifactId gt spring-boot-starter-data-mongodb lt  artifactId gt           lt  dependency gt   lt  --         lt dependency gt               lt groupId gt org springframework boot lt  groupId gt               lt artifactId gt spring-boot-starter-security lt  artifactId gt           lt  dependency gt -- gt   lt  dependencies gt    It worked fine for me     Disabling it from application properties is deprecated for Spring Boot   2 0

User · Answer

Since security disable option is banned from usage there is still a way to achieve it from pure config without touching any class flies  for me it creates convenience with environments manipulation and possibility to activate it with ENV variable  if you use Boot  spring autoconfigure exclude  org springframework boot autoconfigure security servlet SecurityAutoConfiguration

User · Answer

Use  profile  whatever-name-profile-to-activate-if-needed   on your security configuration class that extends WebSecurityConfigurerAdapter  security ignored      security basic enable  false   NB  I need to debug to know why why exclude auto configuration did not work for me  But the profile is sot so bad as you can still re-activate it via configuration properties if needed

[java] disabling spring security in spring boot app

Examples related to java

Examples related to spring

Examples related to spring-security

Examples related to spring-boot

Examples related to spring-java-config