Spring security 6.0 - unable to configure access to public resources - spring-security

Question

Spring Security by default provides forced authentication for all our endpoints, regardless of whether we add role-based security or not.
here is the setup pom.xml
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.0.0</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<properties>
<java.version>17</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-configuration-processor</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
configuration
#EnableWebSecurity(debug = true)
//#EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
public class SecurityConfig {
#Value("${spring.security.debug:false}")
boolean securityDebug;
#Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf()
.disable()
.authorizeHttpRequests()
.requestMatchers("/hello/**")
.permitAll()
.requestMatchers(HttpMethod.DELETE)
.hasRole("ADMIN")
.requestMatchers("/admin/**")
.hasAnyRole("ADMIN")
.requestMatchers("/protected/**")
.hasAnyRole("USER", "ADMIN")
.and()
.httpBasic()
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
return http.build();
}
#Bean
public WebSecurityCustomizer webSecurityCustomizer() {
return web -> web.debug(securityDebug)
.ignoring()
.requestMatchers("/css/**", "/js/**", "/img/**", "/lib/**", "/favicon.ico");
}
}
#Configuration
public class UserDetailServiceConfig {
#Bean
public UserDetailsService userDetailsService(BCryptPasswordEncoder bCryptPasswordEncoder) {
InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
manager.createUser(User.withUsername("user")
.password(bCryptPasswordEncoder.encode("userPass"))
.roles("USER")
.build());
manager.createUser(User.withUsername("admin")
.password(bCryptPasswordEncoder.encode("adminPass"))
.roles("ADMIN", "USER")
.build());
return manager;
}
#Bean
public BCryptPasswordEncoder bCryptPasswordEncoder() {
return new BCryptPasswordEncoder();
}
}
#RestController
public class AdminRestController {
#GetMapping("admin")
public String getAdminResource(UsernamePasswordAuthenticationToken principal){
String auth = principal
.getAuthorities()
.stream()
.map(GrantedAuthority::getAuthority)
.collect(Collectors.joining(","));
return "/admin -> userName : " + principal.getName() + " - authorities : " + auth;
}
#GetMapping("hello")
public String home() {
return "home";
}
}
401Unauthorized
In addition, this filter can safely skip a user with USER rights to endpoint (/admin).
In order to get to the public endpoint, you need to enter credentials. But the setting I specified was supposed to provide public access.
I have repeatedly encountered such a problem on different versions of Security and have not yet found an explanation.
Maybe someone has ideas on how to get around this problem (when it can occur at all) and why is this happening?

Answer 1

#Configuration
public class MySecurityConfigurer {
#Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf()
.disable()
.authorizeHttpRequests()
.requestMatchers("/home/**")
.permitAll()
.requestMatchers(HttpMethod.DELETE)
.hasRole("ADMIN")
.requestMatchers("/admin/**")
.hasRole("ADMIN")
.requestMatchers("/protected/**")
.hasAnyRole("USER", "ADMIN")
.and()
.httpBasic()
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
return http.build();
}
}
I have removed the annotation #EnableWebSecurity.
Here's what I found about it:
The #EnableWebSecurity annotation is needed to completely disable the default web application security configuration.
#EnableWebSecurity causes Spring Boot auto-configuration to be canceled, however, this will not cancel the default setting for authentication manager configuration or the setting for Actuator's security.
In addition, if you use Spring boot, during the auto-configuration of classes, it will automatically configure the components of the security module.
So if you define #Configuration with #EnableWebSecurity anywhere in your application it will disable the default web application security settings in Spring Boot.
The application now performs the expected behavior.

Answer 2

Spring Security effectively secures all endpoints by default, which is desirable. Because a security breach can happen very quickly if you forget to configure something.
That said, you can explicitly allow certain endpoints to everyone by using the permitAll method without messing with annotations.
in your current setup you can shorten like this :
#Configuration
#EnableWebSecurity
public class MySecurityConfigurer {
#Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf()
.disable()
.authorizeHttpRequests()
.requestMatchers("/home/**").permitAll()
.requestMatchers("/admin/**").hasRole("ADMIN")
.requestMatchers("/protected/**").hasAnyRole("USER", "ADMIN")
.and()
.httpBasic()
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
return http.build();
}
}
Will produce the effect that home is public, admin is reserved for user with ADMIN role, and protected is reserved for user with ADMIN or USER role.
Does this answer your problem ?