How to whitelist single endpoint in Spring Boot application?

Question

I am new to Spring Boot and trying to find out the way to whitelist an end-point. I have enabled the Spring Security.

I have a controller class with endpoint Hello, which should return "hello" in response and want anyone to be able to access this endpoint without authentication required.

@RestController
@RequestMapping(value = {"/employee"})

public class EmployeeController {

    @Autowired
    EmployeeRepository empRepose;

    @Autowired
    EmployeeService empService;

    @Autowired
    private Utility utility;

    @PreAuthorize("permitAll()")
    @GetMapping(value = "/hello", produces = MediaType.APPLICATION_JSON_VALUE)
    public String home() {
        return "Hello Employee!";
    }
}

Spring Security configuration:

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
@EnableWebSecurity
public class ApplicationBasicAuth extends WebSecurityConfigurerAdapter {

    @Autowired
    RegisterUser beanRegisteruser;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
       /* httpSecurity.csrf().disable()
                .authorizeRequests().anyRequest().authenticated()
                .and().httpBasic();*/

              /*httpSecurity
                        .httpBasic()
                        .and()
                        .authorizeRequests()
                        .antMatchers(HttpMethod.GET, "/employee/**").permitAll()
                        .and()
                        .csrf().disable();*/

        httpSecurity.csrf().disable();

        httpSecurity.authorizeRequests().anyRequest().permitAll();

    }

I tried so many ways to whitelist all endpoints or even 1 endpoint for which I don't need to go for authentication.

Please, help me to find out what I am doing wrong here.

Answer 1

You can achieve using configure(WebSecurity web) and/or configure(HttpSecurity http) If you are using both of them note that you have to keep configure(WebSecurity web) above configure(HttpSecurity http). You may see more details here

---

configure(WebSecurity web)

General use of WebSecurity ignoring() method omits Spring Security and none of Spring Security’s features will be available.

@Override
public void configure(WebSecurity web) throws Exception {
    web
        .ignoring()
        .antMatchers("/hello")
}

---

configure(HttpSecurity http)

You can also use configure(HttpSecurity http) method with .permitAll() as below

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable()
        .authorizeRequests()
        .antMatchers("/hello").permitAll()
        .anyRequest().authenticated();
}