SpringBoot basic auth ignore URLs ending with .wsdl

Question

I'm using basicAuth in my spring boot project.

There is a requirement that service URLs should be authenticated, while on WSDL, there should be no authentication.

I want to maintain all the authenticated & ignored URLs in application.yml file.

Something like:

auth.authenticated: /onlineshop/v1/ecart,/onlineshop/v1/wishlist
auth.ignored: /onlineshop/v1/ecart.wsdl,/onlineshop/v1/wishlist.wsdl


@EnableWebSecurity
@Configuration
class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${auth.authenticated}")
    String[] allAuthenticated;

    @Value("${auth.ignored}")
    String[] allIgnored;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // Something like
        for (String ignored: allIgnored) {
            http.authorizeRequests().antMatchers(ignored).permitAll();
        }

        // Something like
        for (String authenticated: allAuthenticated) {
            http.authorizeRequests().antMatchers(authenticated).authenticated();
        }
        ....
    }

}

Above code is a rough draft ( sorry for that ), but I've tried coding along these lines but it is not working.

It is not applying any sort of authentication.

Please suggest how can I make this work.

Also, instead of ignoring selective URLs ending .wsdl, how can I ignore all URLs ending with .wsdl

Thank You

Answer 1

First of all, I believe you should do a whitelisting approach for allowing unauthenticated accesses. Therefore I have removed allAuthenticated parameter and required authentication for every url which is not in allIgnored parameter, which is safer by design.

Below configuration is sufficient for the feature you required.

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${auth.ignored}")
    private String[] allIgnored;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers(allIgnored).permitAll()
            .anyRequest().authenticated()
            .and()
            .httpBasic();
    }

}

Note that since antMatchers() requires String[] , you don't need to iterate the loop yourself.

If you still want to configure with allAuthenticated you just need to add .antMatchers(allAuthenticated).authenticated() to the configuration.