Expose an unsecure Restful endpoint in a Springboot Secured application - spring-security

Question

I want to expose an unsecure Restful endpoint in a Springboot secured application. GET requests to the endpoint /api/notify work, but POST requests result in a 403. How do I configure so that remote clients can POST to /api/notify from there server?
My extended WebSecurityConfigurerAdapter looks like this:
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/").permitAll()
.antMatchers("/signup").permitAll()
.antMatchers("/reset").permitAll()
.antMatchers("/api/notify").permitAll()
.anyRequest().authenticated();
http
.formLogin()
.defaultSuccessUrl("/home")
.failureUrl("/login?error")
.loginPage("/login")
.permitAll()
.and()
.logout()
.permitAll();
}

Answer 1

I think this is what you are looking for:
#Configuration
#EnableWebMvcSecurity
public class SecurityCtxConfig extends WebSecurityConfigurerAdapter {
#Override
public void configure(WebSecurity web) throws Exception {
web.ignoring()
.antMatchers(HttpMethod.POST,
"<YOUR URL>");
}

Answer 2

I suggest you try the folllowing configuration:
protected void configure(HttpSecurity http) throws Exception {
//This reads, invoke this configuration only when
//the pattern "/api/notify" is found.
//When this configuration is invoked, restrict access,
//disable CSRF, and if the path matches "/api/notify" permit all.
http.antMatcher("/api/notify")
.csrf().disable()
.authorizeRequests()
.antMatchers("/api/notify")
.permitAll();
//Your other configuration...
http
.authorizeRequests()
.antMatchers("/").permitAll()
.antMatchers("/signup").permitAll()
.antMatchers("/reset").permitAll()
.anyRequest().authenticated();
http
.formLogin()
.defaultSuccessUrl("/home")
.failureUrl("/login?error")
.loginPage("/login")
.permitAll()
.and()
.logout()
.permitAll();
}