如何使用spring安全性仅保护一个URL并允许所有

Question

Im trying to configure Spring security to block only request to swagger, however it is blocking all urls. Does anyone know how to only lock the swagger's url and leave all the rest not secured?

protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable()
        .authorizeRequests().anyRequest().permitAll()
        .and()
        .authorizeRequests()
            .antMatchers("/swagger*/**").authenticated();

        http.httpBasic();
    }

Answer 1

Try the following:

http.authorizeRequests()
.antMatchers("/swagger*/**").authenticated()
.anyRequest().permitAll()
.and()
.csrf().disable();

This should only authenticate swagger but permit the rest of the requests.

Answer 2

Is this what you intent ?

protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable()
    .authorizeRequests()
        .antMatchers("/swagger*/**").authenticated()
        .anyRequest().permitAll();            

    http.httpBasic();
}