Spring Security exclude url patterns in security annotation configurartion

Question

I have spring web application with Spring security configured using java config approach  I want to exclude some URL patterns from authentication eg  static resources etc     I have done this earlier with spring security xml config but couldn t figure out with java config as adding antmatchers doesn t help   Following is my code added in security config class extending WebSecurityConfigurerAdapter   Override public void configure HttpSecurity http  throws Exception       http authorizeRequests                antMatchers   authFailure                permitAll                anyRequest                authenticated                and                httpBasic                and                authenticationProvider  provider               sessionManagement                sessionCreationPolicy SessionCreationPolicy STATELESS               and                addFilter authFilter                 addFilterAfter executionContextFilter                        TokenBasedSecurityFilter class  csrf   disable        The spring security version that I use is 3 2 0  Thanks in advance for helping  Edit   The stacktrace that I got while hitting the excluded URL   org springframework security authentication AuthenticationServiceException  Authorization Header is not available in the request     at com inventory ricemill tba spring TokenBasedSecurityFilter doFilter TokenBasedSecurityFilter java 59      at org springframework security web FilterChainProxy VirtualFilterChain doFilter FilterChainProxy java 342      at org springframework security web authentication logout LogoutFilter doFilter LogoutFilter java 110      at org springframework security web FilterChainProxy VirtualFilterChain doFilter FilterChainProxy java 342      at org springframework security web header HeaderWriterFilter doFilterInternal HeaderWriterFilter java 57      at org springframework web filter OncePerRequestFilter doFilter OncePerRequestFilter java 107      at org springframework security web FilterChainProxy VirtualFilterChain doFilter FilterChainProxy java 342      at org springframework security web context SecurityContextPersistenceFilter doFilter SecurityContextPersistenceFilter java 87      at org springframework security web FilterChainProxy VirtualFilterChain doFilter FilterChainProxy java 342      at org springframework security web context request async WebAsyncManagerIntegrationFilter doFilterInternal WebAsyncManagerIntegrationFilter java 50      at org springframework web filter OncePerRequestFilter doFilter OncePerRequestFilter java 107      at org springframework security web FilterChainProxy VirtualFilterChain doFilter FilterChainProxy java 342      at org springframework security web FilterChainProxy doFilterInternal FilterChainProxy java 192      at org springframework security web FilterChainProxy doFilter FilterChainProxy java 160      at org springframework web filter DelegatingFilterProxy invokeDelegate DelegatingFilterProxy java 343      at org springframework web filter DelegatingFilterProxy doFilter DelegatingFilterProxy java 260      at org apache catalina core ApplicationFilterChain internalDoFilter ApplicationFilterChain java 243      at org apache catalina core ApplicationFilterChain doFilter ApplicationFilterChain java 210      at org apache catalina core StandardWrapperValve invoke StandardWrapperValve java 222      at org apache catalina core StandardContextValve invoke StandardContextValve java 123      at org apache catalina authenticator AuthenticatorBase invoke AuthenticatorBase java 502      at org apache catalina core StandardHostValve invoke StandardHostValve java 171      at org apache catalina valves ErrorReportValve invoke ErrorReportValve java 100      at org apache catalina valves AccessLogValve invoke AccessLogValve java 953      at org apache catalina core StandardEngineValve invoke StandardEngineValve java 118      at org apache catalina connector CoyoteAdapter service CoyoteAdapter java 408      at org apache coyote http11 AbstractHttp11Processor process AbstractHttp11Processor java 1041      at org apache coyote AbstractProtocol AbstractConnectionHandler process AbstractProtocol java 603      at org apache tomcat util net JIoEndpoint SocketProcessor run JIoEndpoint java 310      at java util concurrent ThreadPoolExecutor runWorker ThreadPoolExecutor java 1145      at java util concurrent ThreadPoolExecutor Worker run ThreadPoolExecutor java 615      at java lang Thread run Thread java 744   Apr 01  2014 10 18 41 PM org apache catalina core StandardWrapperValve invoke SEVERE  Servlet service   for servlet  Inventory  in context with path   ricemill  threw exception  Request processing failed  nested exception is org springframework security authentication AuthenticationServiceException  Authorization Header is not available in the request  with root cause org springframework security authentication AuthenticationServiceException  Authorization Header is not available in the request     at com inventory ricemill tba spring TokenBasedSecurityFilter doFilter TokenBasedSecurityFilter java 59      at org springframework security web FilterChainProxy VirtualFilterChain doFilter FilterChainProxy java 342      at org springframework security web authentication logout LogoutFilter doFilter LogoutFilter java 110      at org springframework security web FilterChainProxy VirtualFilterChain doFilter FilterChainProxy java 342      at org springframework security web header HeaderWriterFilter doFilterInternal HeaderWriterFilter java 57      at org springframework web filter OncePerRequestFilter doFilter OncePerRequestFilter java 107      at org springframework security web FilterChainProxy VirtualFilterChain doFilter FilterChainProxy java 342      at org springframework security web context SecurityContextPersistenceFilter doFilter SecurityContextPersistenceFilter java 87      at org springframework security web FilterChainProxy VirtualFilterChain doFilter FilterChainProxy java 342      at org springframework security web context request async WebAsyncManagerIntegrationFilter doFilterInternal WebAsyncManagerIntegrationFilter java 50      at org springframework web filter OncePerRequestFilter doFilter OncePerRequestFilter java 107      at org springframework security web FilterChainProxy VirtualFilterChain doFilter FilterChainProxy java 342      at org springframework security web FilterChainProxy doFilterInternal FilterChainProxy java 192      at org springframework security web FilterChainProxy doFilter FilterChainProxy java 160      at org springframework web filter DelegatingFilterProxy invokeDelegate DelegatingFilterProxy java 343      at org springframework web filter DelegatingFilterProxy doFilter DelegatingFilterProxy java 260      at org apache catalina core ApplicationFilterChain internalDoFilter ApplicationFilterChain java 243      at org apache catalina core ApplicationFilterChain doFilter ApplicationFilterChain java 210      at org apache catalina core StandardWrapperValve invoke StandardWrapperValve java 222      at org apache catalina core StandardContextValve invoke StandardContextValve java 123      at org apache catalina authenticator AuthenticatorBase invoke AuthenticatorBase java 502      at org apache catalina core StandardHostValve invoke StandardHostValve java 171      at org apache catalina valves ErrorReportValve invoke ErrorReportValve java 100      at org apache catalina valves AccessLogValve invoke AccessLogValve java 953      at org apache catalina core StandardEngineValve invoke StandardEngineValve java 118      at org apache catalina connector CoyoteAdapter service CoyoteAdapter java 408      at org apache coyote http11 AbstractHttp11Processor process AbstractHttp11Processor java 1041      at org apache coyote AbstractProtocol AbstractConnectionHandler process AbstractProtocol java 603      at org apache tomcat util net JIoEndpoint SocketProcessor run JIoEndpoint java 310      at java util concurrent ThreadPoolExecutor runWorker ThreadPoolExecutor java 1145      at java util concurrent ThreadPoolExecutor Worker run ThreadPoolExecutor java 615      at java lang Thread run Thread java 744    The request goes through the filters registered in spring security filter chain  while it shouldn t as the request is ignored with antmatcher

User · Answer

specifying the  antMatcher  before  authorizeRequests    like below will restrict the authenticaiton to only those URLs specified in   antMatcher   http csrf   disable            antMatcher   apiurlneedsauth      authorizeRequests

User · Answer

Where are you configuring your authenticated URL pattern s   I only see one uri in your code   Do you have multiple configure HttpSecurity  methods or just one  It looks like you need all your URIs in the one method   I have a site which requires authentication to access everything so I want to protect     However in order to authenticate I obviously want to not protect  login  I also have static assets I d like to allow access to  so I can make the login page pretty  and a healthcheck page that shouldn t require auth   In addition I have a resource   admin  which requires higher privledges than the rest of the site    The following is working for me    Override protected void configure HttpSecurity http  throws Exception        http authorizeRequests            antMatchers   login     permitAll            antMatchers   healthcheck     permitAll            antMatchers   static      permitAll            antMatchers   admin      access  hasRole  ROLE ADMIN              antMatchers        access  hasRole  ROLE USER              and                formLogin   loginPage   login   failureUrl   login error                    usernameParameter  username   passwordParameter  password            and                logout   logoutSuccessUrl   login logout            and                exceptionHandling   accessDeniedPage   403            and                csrf         NOTE  This is a first match wins so you may need to play with the order  For example  I originally had     first            antMatchers        access  hasRole  ROLE USER              antMatchers   login     permitAll            antMatchers   healthcheck     permitAll     Which caused the site to continually redirect all requests for  login back to  login  Likewise I had  admin    last            antMatchers        access  hasRole  ROLE USER              antMatchers   admin      access  hasRole  ROLE ADMIN       Which resulted in my unprivledged test user  guest  having access to the admin interface  yikes

User · Answer

When you say adding antMatchers doesnt help - what do you mean  antMatchers is exactly how you do it  Something like the following should work  obviously changing your URL appropriately     Override     public void configure HttpSecurity http  throws Exception           http authorizeRequests                    antMatchers   authFailure   permitAll                    antMatchers   resources      permitAll                    anyRequest   authenticated     If you are still not having any joy  then you will need to provide more details stacktrace etc   Details of XML to Java config switch is here

User · Answer

Found the solution in Spring security examples posted in Github   WebSecurityConfigurerAdapter has a overloaded configure message that takes WebSecurity as argument which accepts ant matchers on requests to be ignored    Override public void configure WebSecurity web  throws Exception       web ignoring   antMatchers   authFailure        See Spring Security Samples for more details

[spring] Spring Security exclude url patterns in security annotation configurartion

Examples related to spring

Examples related to spring-mvc

Examples related to spring-security

Examples related to basic-authentication