Spring Boot: Disable Client Auth for specific URL

Question

I have the below config in my application.yml

server:
  #address:
  port: 8443
  sessionTimeout: 30
  ssl:
    client-auth: need
    key-store: keyStore.jks
    key-store-password: 12345
    key-password: datacert

    protocol: TLS
    trust-store: truststore.jks
    trust-store-password: 12345

Since I have client-auth: need, my application is prompting for certificate for all the URL's, is there anyway I can bypass client auth for some specific URL's like /info or \health URLs?

Answer 1

Spring boot does not allow to mix http and https. It is also not suggested to mix the URL's with insecure pages.

If you need only certain URL's to be secure please implement a custom authentication as by default the SSL handshake will happen for each and every request.

You can refer these discussions: How set up Spring Boot to run HTTPS / HTTP ports

For instance the request will reach to the server only after it is authenticated.

You may try to create and capture the request using Filters but I doubt that you will get the request at server before it is authenticated by web server.

e.g. Try adding java Filter and capture the required URL's to filter secure and non secure. (Filter is configurable under web.xml or as annotation). Other option is to try Spring Security filter chain proxy.