Java based configuration to enable spring security anonymous access

Question

I want to enable the use of "ROLE_ANONYMOUS" to allow anonymous access to some urls in my app. And I used the below configuration.

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .requestCache()
            .requestCache(new NullRequestCache()).and()
        .anonymous().authorities("ROLE_ANONYMOUS").and()
        .exceptionHandling().and()
        .servletApi().and()
        .headers().cacheControl().and()
        .authorizeRequests()
            .antMatchers("/").permitAll()
            .antMatchers("/profile/image").permitAll()
            .antMatchers("/favicon.ico").permitAll()
            .antMatchers("/resources/**").permitAll()

            //.antMatchers(HttpMethod.GET, "/login/**").permitAll()
            //.antMatchers(HttpMethod.GET, "/location/**").permitAll()

            .anyRequest().authenticated()/*.and()
            .apply(new SpringSocialConfigurer())*/;

        // custom Token based authentication based on the header previously given to the client
        //.addFilterBefore(new StatelessAuthenticationFilter(tokenAuthenticationService), UsernamePasswordAuthenticationFilter.class);
}

My controller looks like:

@RestController
@RequestMapping(value="/login", produces="application/json")
public class LoginController {


    @Secured( value={"ROLE_ANONYMOUS"})
    @RequestMapping(method=RequestMethod.GET)
    public String get(){
        return "hello";
    }
}

But when I try to hit "/login" I get 403 access denied error. Please help me how I can enable annotation based anonymous access.

Answer 1

This should solve your issue.

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        ...
        .formLogin().loginPage("/login").permitAll()
        ...

But if you prefer not to use permitAll but to stick to anonymous roled user (it would be the same effect on both situation but yet if that's wht you prefer) then try this in the controller.

@Secured("ROLE_ANONYMOUS")
@RequestMapping(method=RequestMethod.GET)
public String get(){
    ...