Understanding the difference of permitAll() and anonymous() in Spring Security

Question

I just want to make sure if I get this correctly, so I would be thankful for any response; in my configure-override:

@Override
protected void configure(HttpSecurity http) throws Exception
{
    http.
        [...]
        permitAll()
        [...]
}

the permitAll() allows any request, while:

anonymous()

will only grant access for users that are not logged in but in both cases a HttpSession-Object is created by default.

Is that right?

Answer 1

From the Spring documentation:

It's generally considered good security practice to adopt a “deny-by-default” where you explicitly specify what is allowed and disallow everything else. Defining what is accessible to unauthenticated users is a similar situation, particularly for web applications. Many sites require that users must be authenticated for anything other than a few URLs (for example the home and login pages). In this case it is easiest to define access configuration attributes for these specific URLs rather than have for every secured resource. Put differently, sometimes it is nice to say ROLE_SOMETHING is required by default and only allow certain exceptions to this rule, such as for login, logout and home pages of an application. You could also omit these pages from the filter chain entirely, thus bypassing the access control checks, but this may be undesirable for other reasons, particularly if the pages behave differently for authenticated users.

This is what we mean by anonymous authentication.

and

Note that there is no real conceptual difference between a user who is "anonymously authenticated" and an unauthenticated user. Spring Security’s anonymous authentication just gives you a more convenient way to configure your access-control attributes.

Using the .permitAll() will configure the authorization so that all requests(both from anonymous and logged in users) are allowed on that particular path.

The .anonymous() expression mainly refers to the status of the user(logged in or not). Basically until a user is "authenticated" it is an "Anonymous user". It is like having a "default role" for everybody.