排除对 URL 的请求通过 Spring Security 过滤器运行

Question

I have a Spring boot application, and a custom authentication filter. The application has a URL "/" where I'd like to avoid having any Spring Security filters being run (both authentication and authorization), including my custom filter.

I do not want to configure WebSecurity to ignore this URL, as there are some other Spring Security features that I would like to apply, and my understanding is that using:

webSecurityBuilder.ignoring().antMatchers("/");

Would keep all Spring Security features from running on this URL.

Is there a way to use HttpSecurity for this?

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthenticationFilter customAuthFilter;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        
http.antMatcher("/").
                anonymous().and().authorizeRequests()
                .antMatchers("/", "/index.html").permitAll()
                .anyRequest().authenticated();

        http.addFilterBefore(customAuthFilter, UsernamePasswordAuthenticationFilter.class);

    }

This is what I have so far, but for some reason when I navigate to "/" I still hit my custom filter.

Answer 1

The below is solution. The abstract is that you should define two WebSecurityConfigurerAdapter with different order. Pls take a try. solution

The below code is copied from there.

@Configuration
@Order(1)
public class OnlyHeadersConfig extends WebSecurityConfigurerAdapter {
    protected void configure(HttpSecurity http) {
        http
            .antMatchers("/special/endpoints/**")
                .authorizeRequests((authz) -> authz.anyRequest().permitAll())
                .anonymous();
    }
}

@Configuration
@Order(2)
public class MainSecurityConfig extends WebSecurityConfigurerAdapter {
    protected void configure(HttpSecurity http) {
        http
            .authorizeRequests(authz -> authz.anyRequest().authenticated())
            .addFilterAt(new MyCustomFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}