'Spring security Apply authorization only for specific URI and permit all other URI with no auth
I am adding a new WebSecurityConfigurerAdapter and i want to apply a custom validation filter only for two specific URIs and for all others URIs i dont want to validate the authorization header. These two end points are called by another system and it passes Authorization header for validation. For all other end points, we use a different WebSecurityConfigurerAdapter. The issue is that, with below config, requests to all endpoints are going through the JwtTokenFilter. But i want only those two specific end points requests to go through JwtTokenFilter. Please help to figure out what us wrong
class JwtSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().disable().csrf().disable()
.requestMatchers()
//apply the custom JwtTokenFilter only for the below two endpoints
.antMatchers(
"/api/endpoint1",
"/api/endpoint2")
.and()
.addFilterAfter(new JwtTokenFilter(), BasicAuthenticationFilter.class)
//For all other endpoints, do not apply above filter
.authorizeRequests().anyRequest().permitAll();
}
}
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
