Web ignoring using spring-webflux

Question

In spring-mvc is possible to extends from WebSecurityConfigurerAdapter , override configure(WebSecurity web) and do somethink like this:

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers(AUTH_WHITE_LIST);
}

The main benefit of this approach is that spring-security even will not try to decode passed token. Is it possible to do pretty much the same but using webflux?

I know that i can do like this:

@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) throws Exception {
    http.csrf().disable()
            .authorizeExchange().pathMatchers(AUTH_WHITE_LIST).permitAll()
            .anyExchange().authenticated();
    return http.build();
}

But this way, as far as i know, spring-security will try to parse provided token first.

Answer 1

As far as I know, the equivalent of making sure paths (and tokens) are ignored by spring security in webflux is to use the securityMatcher() method on ServerHttpSecurity. I.e. it should be the same as using the WebSecurity#ignoring() method with antMatchers.

@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    return http.securityMatcher(new NegatedServerWebExchangeMatcher(
                ServerWebExchangeMatchers.pathMatchers("/ignore/this/path")))
            .authorizeExchange()
                .anyExchange().authenticated()
            .and()
                .csrf().disable()
             .build();
}