It's old question but when I was looking for answer I came here, so after I make it work with newer version, I decided to share my answer, maybe someone find it useful.
This is my implementation for spring security - 3.1.0 and openApi 2.1.0 with gradle:
implementation "org.springframework.boot:spring-boot-starter-security:3.1.0"
implementation "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.1.0"
@EnableWebSecurity
public class SecurityConfiguration {
@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf().disable()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeHttpRequests()
.requestMatchers("/swagger-ui/**",
"/swagger-resources/*",
"/v3/api-docs/**")
.permitAll()
.anyRequest()
.authenticated();
return http.build();
}
}
You need to specify paths in requestMatcher like "/bus/v3/api-docs".
The best option is to implement it one by one:
- check if "/**" works, then
- check if /bus/** works (in my case matcher with default path "/api" which is set for whole project and whole path looked like this - /api/swagger-ui/** didn't work, but /swagger-ui/** worked)
- then another check if /bus/v3/** work
** - two stars are wildcard.
Even my path for swagger looks like this: api/swagger-ui/index.html#/
I needed to add matcher: v3/api-docs/** to make it work.