Spring security how to allow root url without intefering with security 'below' the root

user_7501352 0
Viewed 566

I have REST services and static pages, both delivered by my Spring Boot application.

The application action is to be reached under /myapp, while under /myapp/api there are services that are protected by a filter. The filter expects a cookie.

@Override
protected void configure(final HttpSecurity http) throws Exception {

   http.authorizeRequests()
            .antMatchers("/api/**")
            .permitAll()
            .and()
            .addFilter(new CookieFilter(...));
}

The unprotected pages in the 'root-context (/myapp) have no cookie.

How can I configure that the static pages are 'ignored' by Spring security? While the REST endpoints below the static pages are checked by security?

When I try to configure the static pages for 'exclusion' via Web Security, all REST endpoints under /myapp/api are ignored as well

@Override
public void configure(final WebSecurity web) {
   web.ignoring()
            .antMatchers("/");
}

If I configure a permitAll():

@Override
protected void configure(final HttpSecurity http) throws Exception {

    http.authorizeRequests().antMatchers("/").permitAll();

    http.authorizeRequests()
            .antMatchers("/api/**")
            .permitAll()
            .and()
            .addFilter(new CookieFilter(...));

}

Spring security complains that the static pages can not be checked by my security filter, so the authorization is performed.

spring-boot spring-security
1 Answers

This will make anything under /api require authentication and let everything else through.

http.authorizeRequests()
            .antMatchers("/api/**").authenticated()
            .anyRequest().permitAll()
            .and()
            .addFilter(new CookieFilter(...));
user_9394870
Related