Geek Answers Handbook

Spring Confusion Anonymous Security Access Using Java Config

I am using the following Java configuration with Spring Security:

protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .anyRequest().authenticated() .and() .httpBasic(); }

Based on this configuration, all requests are authenticated. When you click the controller without authentication, AnonymousAuthenticationFilter will create an authentication object for you with username=anonymousUser, role=ROLE_ANONYMOUS .

I am trying to provide anonymous access to a specific controller method and have tried using each of the following:

  • @Secured("ROLE_ANONYMOUS")
  • @Secured("IS_AUTHENTICATED_ANONYMOUSLY")

When the controller methods are called, the following response is issued: "HTTP status 401 - full authentication is required to access this resource

Can someone help me understand why we are getting this message and why ROLE_ANONYMOUS / IS_AUTHENTICATED_ANONYMOUSLY does not seem to work using this configuration?

Thanks,
In JP

+7
java spring spring-java-config spring-security
source share
1 answer

Your security configuration blocks all unauthorized requests. You must allow access to the controller using

 .antMatchers("/mycontroller").permitAll()

See also:

+3
source share

More articles:


All Articles