How to whitelist single endpoint in Spring Boot application? - rest

Question

I am new to Spring Boot and trying to find out the way to whitelist an
end-point. I have enabled the Spring Security.
I have a controller class with endpoint Hello, which should return "hello"
in response and want anyone to be able to access this endpoint without authentication required.
#RestController
#RequestMapping(value = {"/employee"})
public class EmployeeController {
#Autowired
EmployeeRepository empRepose;
#Autowired
EmployeeService empService;
#Autowired
private Utility utility;
#PreAuthorize("permitAll()")
#GetMapping(value = "/hello", produces = MediaType.APPLICATION_JSON_VALUE)
public String home() {
return "Hello Employee!";
}
}
Spring Security configuration:
#Configuration
#EnableGlobalMethodSecurity(prePostEnabled = true)
#EnableWebSecurity
public class ApplicationBasicAuth extends WebSecurityConfigurerAdapter {
#Autowired
RegisterUser beanRegisteruser;
#Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
/* httpSecurity.csrf().disable()
.authorizeRequests().anyRequest().authenticated()
.and().httpBasic();*/
/*httpSecurity
.httpBasic()
.and()
.authorizeRequests()
.antMatchers(HttpMethod.GET, "/employee/**").permitAll()
.and()
.csrf().disable();*/
httpSecurity.csrf().disable();
httpSecurity.authorizeRequests().anyRequest().permitAll();
}
I tried so many ways to whitelist all endpoints or even 1 endpoint for which I don't need to go for authentication.
Please, help me to find out what I am doing wrong here.

Answer 1

You can achieve using configure(WebSecurity web) and/or configure(HttpSecurity http) If you are using both of them note that you have to keep configure(WebSecurity web) above configure(HttpSecurity http). You may see more details here
configure(WebSecurity web)
General use of WebSecurity ignoring() method omits Spring Security and none of Spring Security’s features will be available.
#Override
public void configure(WebSecurity web) throws Exception {
web
.ignoring()
.antMatchers("/hello")
}
configure(HttpSecurity http)
You can also use configure(HttpSecurity http) method with .permitAll() as below
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/hello").permitAll()
.anyRequest().authenticated();
}