spring security webSecurity.ignoring()

Question

I am using spring security via spring boot. I have two kinds of rest services.

public/** --> Every one can access and use these services

secure/** --> Only authenticated users can use.

@Slf4j
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
public void configure(WebSecurity webSecurity) throws Exception {
    webSecurity.ignoring().antMatchers("/public/**");
}

@Override
protected void configure(HttpSecurity http) throws Exception {

    http.addFilterBefore(requestHeaderAuthenticationFilter(authenticationManager()),
            BasicAuthenticationFilter.class)
            .authorizeRequests().antMatchers("/secure/**").fullyAuthenticated();
}

@Bean
public RequestHeaderAuthenticationFilter requestHeaderAuthenticationFilter(
        final AuthenticationManager authenticationManager) {

    RequestHeaderAuthenticationFilter filter = new RequestHeaderAuthenticationFilter();
    filter.setAuthenticationManager(authenticationManager);
    filter.setExceptionIfHeaderMissing(true);
    filter.setPrincipalRequestHeader("MY_HEADER");
    filter.setInvalidateSessionOnPrincipalChange(true);
    filter.setCheckForPrincipalChanges(false);
    filter.setContinueFilterChainOnUnsuccessfulAuthentication(false);
    return filter;
}

When i want to access a resource under public i got exception.

exception: "org.springframework.security.web.authentication.preauth.PreAuthenticatedCredentialsNotFoundException"

message: "MY_HEADER header not found in request."

Why does my filter activated under public resource while it is configured as ignored resource?

Thanks is advance

Answer 1

This is an issue in WebSecurity.ignoring() as discussed in Spring Security Github when using Beans as Filters.

You can work around this by removing the @Bean annotation in your Filter declaration.

// @Bean - Remove or Comment this
public RequestHeaderAuthenticationFilter requestHeaderAuthenticationFilter(
        final AuthenticationManager authenticationManager) {

    RequestHeaderAuthenticationFilter filter = new RequestHeaderAuthenticationFilter();
    filter.setAuthenticationManager(authenticationManager);
    filter.setExceptionIfHeaderMissing(true);
    filter.setPrincipalRequestHeader("MY_HEADER");
    filter.setInvalidateSessionOnPrincipalChange(true);
    filter.setCheckForPrincipalChanges(false);
    filter.setContinueFilterChainOnUnsuccessfulAuthentication(false);
    return filter;
}