0

I've spring security configured like this:

@EnableWebSecurity
@Order(1)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable().authorizeRequests()
      .antMatchers("/rest/app/health").permitAll()
      .antMatchers("/*/app/**").authenticated()
      .antMatchers("/**").permitAll().and().httpBasic();
  }

  @Override
  public final void configure(final WebSecurity web) throws Exception {
    super.configure(web);
    web.httpFirewall(new DefaultHttpFirewall());
  }

}

I've only included spring security and not oauth2. Due to some reason if someone is accessing any permitted url for eg. /rest/app/health with Authorization header he is getting 401 Unauthorized. It's working fine without the header.

How can I ignore the Authorization header, because I need this header as a request param to delegate my request to a third party service.

Heisenberg
  • 5,514
  • 2
  • 32
  • 43
  • Possible duplicate of https://stackoverflow.com/questions/47433314/spring-security-permitall-denies-access-when-sending-authorization-header – dur Oct 04 '18 at 12:09
  • Possible duplicate of [Spring Boot 2: Basic Http Auth causes unprotected endpoints to respond with 401 "Unauthorized" if Authorization header is attached](https://stackoverflow.com/questions/51496100/spring-boot-2-basic-http-auth-causes-unprotected-endpoints-to-respond-with-401) – dur Oct 04 '18 at 12:13

1 Answers1

0

Filters will be executed for all the endpoints that are configured through HttpSecurity. If you do not want filters to be applied for certain endpoints, include them in a method that configures WebSecurity.

You need to change this method

 @Override
  public final void configure(final WebSecurity web) throws Exception {
    super.configure(web);
    web.httpFirewall(new DefaultHttpFirewall());
  }

to:

@Override
    public void configure(WebSecurity web) {
        web.ignoring()
            .antMatchers(HttpMethod.POST, "/rest/app/health");
    }
Gayratjon
  • 86
  • 4