Skipping Oauth 2.0 authorization using additional header param on API Request - Spring Security

Question

I've implemented Oauth 2.0 in SpringBoot API using Spring Security. It's working fine and for the moment there is a requirement on skipping authentication on requesting with an additional header after checking header availability. Basically client-side will add

skip-auth:true //example

then from the server-side, we've to add the filter to check skip-auth value, then if it is true we need to skip authorization and grant permission to access resources.

Does anyone have experience with a working solution on this? or any suggested method that could create this requested functionality

Answer 1

I think bypassing security with some kind of secret header is a really bad idea. Can you change the requirement that they send a fixed BasicAuth Header instead?

Then you can allow Basic-Auth on the relevant endpoints in your WebSecurityConfig.

Answer 2

You should never keep backdoors to your backend. This is clearly one. A simple decompilation of an app or monitoring the network tab in a browser will reveal this seemingly obvious backdoor. You need to work with the people who sent the requirement and ask them to define what endpoints needs complete protection and what can be accessed anonymously.

Endpoints that can be accessed anonymously can be protected with a ROLE_ANONYMOUS and by defining AnonymousAuthenticationFilter in the filter proxy chain.