Spring Boot Security: How to skip login for localhost?

Question

My working spring boot SecurityConfig currently looks like this:

    protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
            .antMatchers("/css/**", "/js/**", "/img/**", "/error", "/webjars/**", "/login", "**/favicon.ico").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin().failureUrl("/login?state=badauth")
            .loginPage("/login")
            .loginProcessingUrl("/processLogin")
            .successHandler(successHandler())
            .failureHandler(failureHandler())
            .permitAll()
            .and()
            .logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout")).logoutSuccessUrl("/login?state=loggedout");
    ;
    }

I am trying to allow users on the localhost to gain access to all resources without logging in. I have tried to insert the following into various locations within the chain:

.antMatchers("/**").access("hasIpAddress(\"127.0.0.1\") or hasIpAddress(\"::1\")")

Which always causes non-localhost access to fail with a forbidden.

How can I bypass login for users on the localhost only?

Answer 1

Try this

DemoApplication.java

@SpringBootApplication
public class DemoApplication {
    public static void main(String[] args) {
        SpringApplication.run(DemoApplication.class, args);
    }
}

TestController.java

@RestController
public class TestController {

    @GetMapping("/secured")
    public ResponseEntity secured() {
        return ResponseEntity.ok("Access granted");
    }

}

WebSecurityConfig.java

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                .antMatchers("/**")
                .access("hasIpAddress('127.0.0.1') or hasIpAddress('::1') or isAuthenticated()")  // 127.0.0.1 and localhost do not need to authenticate on any url
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("user").password(passwordEncoder().encode("password"))
                .authorities("ROLE_USER");
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Answer 2

Try to add hasIpAddress() before authenticated like this:

.antMatchers("/**").hasIpAddress("127.0.0.1").anyRequest().authenticated();

Answer 3

You can try disabling default security in Spring Boot by adding this line in application.properties file of your local/dev profile:
security.basic.enabled=false