Use Spring Security Filter to lock down everything except a few routes

Question

We're reworking our product to remove the default "anonymousUser" behavior in SpringSecurity and would like to lock down all URLs (via filter security) with the exception of just a few endpoints. What we can't figure out is how to specify "lock down everything except X, Y, and Z"

Our security setup essentially boils down to the following:

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // disable anonymous users
            .anonymous().disable()

            // don't add ROLE_ to the role...
            .authorizeRequests()
                .regexMatchers("^/", "^/login", "^/mobile/login", "^/api/auth/.*")
                    .authenticated()
                .and()  
        ;
    }
}

Other routes I've taken have been akin to :

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // disable anonymous users
            .anonymous().disable()

            // don't add ROLE_ to the role...
            .authorizeRequests()
            .antMatchers("/**")
                .authenticated()
            .antMatchers("/", "/login", "/mobile/login", "/api/auth/**", "/reservations/**")
                .permitAll()
            .and()
        ;
    }
}

Any advice / input would be appreciated.

Thanks!

Answer 1

We're reworking our product to remove the default "anonymousUser" behavior in Spring Security

I'm wondering what you mean by this. Based on the rest of the description, I don't think you need the following (i.e. you should remove it):

anonymous().disabled()

The above says that the user will be null if no user is authenticated, which tends to lead to NullPointerExceptions.

Remember that for authorizeRequests() (or for <intercept-url> ) ordering matters. The Java configuration you have (reformatted slightly for readability)

.authorizeRequests()
    .antMatchers("/**").authenticated()
    .antMatchers("/", "/login", "/mobile/login", "/api/auth/**", "/reservations/**").permitAll()
    .and()

is going to use the following logic:

• Does this request match "/**"?
  • Yes, everything matches "/**". So every request requires the user to be authenticated.
• Ignore every other rule because we already matched

Instead you should use the following:

.authorizeRequests()
    .antMatchers("/", "/login", "/mobile/login", "/api/auth/**", "/reservations/**").permitAll()
    .anyRequest().authenticated()
    .and()

• Does the request match "/", or "/login", or ...?
  • If yes, then anyone is allowed to access it and STOP (no more rules are used).
  • If the request does not match, then continue.
• Does the request match any request?
  • Yes, so if the request does not match a previous rule, then it will require the user to be authenticated.

NOTE: antMatchers("/**") is more concisely represented as anyRequest().

Answer 2

The answer from Rob Winch will be the correct answer in nearly all cases and is the approach that I take in my projects. I do think that it is also worth noting that another possible approach could be to do the following:

public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/assets/**", "/index.html");
}

PLEASE NOTE that this is a separate method from the one in the examples you submitted earlier. That method has a parameter of type HttpSecurity while this one is of type WebSecurity.

What this code sample will do is find any requests that match and completely skip the HTTP security filters all together.

So if you want to optimize some requests that you know will need ZERO of the features that HttpSecurity provides then this could be a good solution. This means that if you use features like csrf(), requestCache(), headers() they WILL NOT be applied to the matching requests from the example above ("/assets/**", "/index.html")