Spring Security - permit only requests with prefix

Question

I need to secure all rest endpoints in our Resource Server except endpoints that start with /unsecured. So requests like the following should be permitted to everyone:

/unsecured/foo/bar
/unsecured
...

but requests like these:

/foo/unsecured/bar
/foo/bar
...

should require authentication.

@Configuration
@EnableResourceServer
public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity security) throws Exception {
        security
            .authorizeRequests(authorizeRequests -> {
                authorizeRequests.antMatchers("unsecured/**").permitAll();
                authorizeRequests.anyRequest().authenticated();
            });
    }
}

But in the configuration above, all endpoints require authentication.

This is response which I receive when I tried access to unsecured endpoint:

code 401

{
    "error": "unauthorized",
    "error_description": "Full authentication is required to access this resource"
}

Don't you want `authorizeRequests.antMatchers("unsecured/**").permitAll();` — Alan Hay, Feb 26 '20 at 18:03
@AlanHay Yes I am sorry, I just bad copied my code. Thank you. — Denis Stephanov, Feb 26 '20 at 18:37

Dylan · Accepted Answer · 2020-02-26T19:08:44.643

1

premitAll() is what you are looking for. Looks like you were just missing the / before the URL

@Configuration
@EnableResourceServer
public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter {
    @Override
    public void configure(HttpSecurity security) throws Exception {
        security
            .authorizeRequests(authorizeRequests - > {
                authorizeRequests.antMatchers("/unsecured/**").permitAll();
                authorizeRequests.anyRequest().authenticated();
            });
    }
}

edited Feb 26 '20 at 19:08

answered Feb 26 '20 at 18:14

Dylan

2,161
2
27
51

I am really sorry. I bad copied my code. I already have permitAll() on first line. – Denis Stephanov Feb 26 '20 at 18:36
maybe you need the "/" before unsecured? – Dylan Feb 26 '20 at 18:44
Yes, it works but is weird. Thank you. You can update answer and I will mark it as answer – Denis Stephanov Feb 26 '20 at 18:50

Spring Security - permit only requests with prefix

1 Answers1