CODEWITHSUNDEEP
javaspringspring-mvcspring-security
Hanjun Chen
Hanjun Chen

Reputation: 544

Spring Security permit paths with the same suffix

In my JWT authenticated API I want these paths to be accessible without any authentication, and all other endpoints to be disallowed/disabled:

As you can see most of the above endpoints begin with /apis/id, POST has /apis. Here is my configurations:

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {


    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.authorizeRequests()
           .mvcMatchers(HttpMethod.GET,"/apis/id/**").permitAll()
           .mvcMatchers(HttpMethod.PATCH,"/apis/id/**").permitAll()
           .mvcMatchers(HttpMethod.DELETE,"/apis/id/**").permitAll()
           .mvcMatchers(HttpMethod.POST,"/apis", "/apis/").permitAll()
           .antMatchers(HttpMethod.GET,"/csrf","/v2/api-docs","/swagger-resources/configuration/ui",  "/configuration/ui", "/swagger-resources", "/configuration/security", "/swagger-ui.html", "/webjars/**","/swagger-resources/configuration/ui","/swagger-resources/configuration/security", "/configuration/security").permitAll()// for Swagger UI
        .anyRequest().denyAll();
    }
}

Only GET /apis/id/{id} and /swagger-ui.html get through. The other endpoints with the identical configs (except for POST) all got rejected (403). I added an exception handler and print out the AuthenticationException message, and it says:

Full authentication is required to access this resource path

How do I make these endpoints public? I feel like I am missing some configurations.

Framworks I am using:

Upvotes: 1

Views: 2871

Answers (1)

Royts
Royts

Reputation: 511

You can take a look at this answer for the possible explanation of you problem.

Invoking antMatcher(String) will override previous invocations of mvcMatcher(String), requestMatchers(), antMatcher(String), regexMatcher(String), and requestMatcher(RequestMatcher).

Now that you understand the underlying problem, you can now then change your code into something like this:

http
    .requestMatchers()
        .antMatchers("/apis/id/**", "/csrf","/v2/api-docs","/swagger-resources/configuration/ui",  "/configuration/ui", "/swagger-resources", "/configuration/security", "/swagger-ui.html", "/webjars/**","/swagger-resources/configuration/ui","/swagger-resources/configuration/security", "/configuration/security").permitAll()
        .anyRequest().authenticated();

Upvotes: 2

Related Questions