Disable Basic Authentication for a specific URL Spring

Question

I am new to Spring, and I need to enable Basic authentication for 8/10 URLs of my rest controllers, and the other 2 should be accessible without any Basic Authentication. I am using gradle to build by application, so there is no xml file involved as such. (I saw a few solutions with a web.xml, I do not have one) Here is my web security configuration:

 @Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(WebSecurity web) throws Exception {
        super.configure(web);
        web.ignoring().antMatchers("/abcd/**");

    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user").password("password");

    }
}

Here is my controller:

    @RestController
@RequestMapping(value = "/abcd")
public class PaymentController implements ElasticSearchConstants {

    @RequestMapping(value = "/sample", method = RequestMethod.POST, consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
    public static void authExpemtedController(HttpServletRequest request, HttpServletResponse response) throws Exception {
        //do something
    }
}

I tried the web.ignoring().antMatchers("/abcd/"); not helping. I always get a 401 error when I try from postman: { "timestamp": 1492274727955, "status": 401, "error": "Unauthorized", "message": "Full authentication is required to access this resource", "path": "/abcd/sample" }

I have a requirement to expose an API like this, that does not need ANY authentication, where as the other APIs need to be authernticated.

Thanks for the help in advance

UPDATE: I know about the http.authoriseRequest().antMatchers("/abcd").permitAll() This method only allows any user to access. I do not want to pass ANY user information at all to this API.

Answer 1

you might want to refer to Section 5.4 Authorize Requests of the Spring Security docs:

Our examples have only required users to be authenticated and have done so for every URL in our application. We can specify custom requirements for our URLs by adding multiple children to our http.authorizeRequests() method. For example:

protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()                                                                                    
            .antMatchers("/resources/**", "/signup", "/about").permitAll()                                  
            .antMatchers("/admin/**").hasRole("ADMIN")                                                  
            .antMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')")                        
            .anyRequest().authenticated()
            .and()
        // ...
        .formLogin();
}