Spring webSecurity.ignoring() doesn't ignore custom filter
java, spring, spring-mvc, spring-security
Solution
remove @Component on class EAccessAuthenticationFilter,and like this:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.anyRequest().authenticated()
.and()
.addFilterBefore(new EAccessAuthenticationFilter(), BasicAuthenticationFilter.class);
}
https://github.com/spring-projects/spring-security/issues/3958
Problem
I have a set a custom authentication filter in my Spring 4 MVC + Security + Boot project. The filter does it's job well and now I want to disable the security for some URI (like `/api/**`). Here is my configuration: ``` @Configuration @EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter{ @Override public void configure(WebSecurity webSecurity) throws Exception { webSecurity.ignoring().antMatchers("/api/**"); } @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .anyRequest().authenticated() .and() .addFilterBefore(filter, BasicAuthenticationFilter.class); } } ``` Unfortunately, when I call a resource under `/api/...` the filter is still chained. I've added `println` in my filter and it's written to the console on every call. Do you know what's wrong with my configuration? UPDATE Filter code: ``` @Component public class EAccessAuthenticationFilter extends RequestHeaderAuthenticationFilter { @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { System.out.println("FILTER"); if(SecurityContextHolder.getContext().getAuthentication() == null){ //Do my authentication stuff PreAuthenticatedAuthenticationToken authentication = new PreAuthenticatedAuthenticationToken(user, credential, authorities); SecurityContextHolder.getContext().setAuthentication(authentication); } super.doFilter(request, response, chain); } @Override @Autowired public void setAuthenticationManager(AuthenticationManager authenticationManager) { super.setAuthenticationManager(authenticationManager); } } ```