0

I have a Spring HttpSecurity configuration as

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    http.csrf().disable().httpBasic().and()
        .authorizeRequests()
            .antMatchers("/public/**").permitAll()
            .antMatchers("/secure/**").authenticated()
            .antMatchers("/backend/**").authenticated()
            .antMatchers(HttpMethod.OPTIONS, "/**").permitAll();
}

It might be stupid for the client to set the Authorization Header for '/public/**' endpoints.

However, I noticed Spring Security attempts to authenticate tries to create an authenticated session for even public requests because the Authorization Header was provided.

Should the HttpSecurity config not override this behaviour?

F.O.O
  • 4,730
  • 4
  • 24
  • 34

1 Answers1

0

Answered in the comments:

No it shouldn't... Permit all is something different as not secured at all. For the latter override the 'configure(WebSecurity)' and use the 'ignoring' for no security at all.

Marcus Held
  • 635
  • 4
  • 15