Allow all URLs but one in Spring security

Question

I would like to protect just a single URL, while allowing anonymous access for everything else.

The Java configuration examples i'm seeing in the internet all seem to indicate that you need to explicitly permitAll each and every URL, and appropriate hasRole for URLs that need to be protected. This in my case, creates a really unwieldy java code which I have modify every time I add a new URL to the application. Is there an easier java configuration that I can use.

And note also that in my case, the URL i'm protecting is a sub-resource, say employee/me, I would like employee/list, etc., to be anonymously accessible.

Answer 1

If you're using Java Configuration, you can use something like following in your configure method:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
                .antMatchers("/employee/me").authenticated()
                .antMatchers("/**").permitAll();
}