Spring Security permitAll not allowing anonymous access

Question

I have a single method that I want to allow both anonymous and authenticated access to. I am using Spring Security 3.2.4 with Java based configuration. The overridden configure method (in my custom configuration class extending `WebSecurityConfigurerAdapter`) has the following `http` block: ``` http .addFilterBefore(muiltpartFilter, ChannelProcessingFilter.class) .addFilterBefore(cf, ChannelProcessingFilter.class) .authorizeRequests() .anyRequest() .authenticated() .and() .authorizeRequests() .antMatchers("/ping**") .permitAll() .and() .formLogin() .loginPage("/login") .permitAll() .and() .logout() .logoutUrl("/logout") .logoutSuccessUrl("/login"); ``` The ping request handler and method is in a controller that also contains the login handler, and it has no separate `@PreAuthorize` or other annotations that might cause the issue. The problem is that anonymous access is denied and the user is redirected to the login page. Logging at the debug level, I see the following feedback from Sp…

Accepted Answer

The permission order is important, it works when I configure it like this:

```
.authorizeRequests()
        .antMatchers("/ping**")
        .permitAll()
        .and()
.authorizeRequests()
        .anyRequest()
        .authenticated()
        .and()
```

Spring Security permitAll not allowing anonymous access

Solution

Problem

Related problems