1. Overview
Spring Security provides multiple mechanisms to configure request patterns as unsecured or to allow unrestricted access. In this article, we’ll explore two commonly used approaches: permitAll() and web.ignoring() and how they work within Spring Security.
How to map Roles and Privileges for a Spring Security application: the setup, the authentication and the registration process.
2. Configuring Access With permitAll()
Configuring permitAll() allows all requests on the specified path without disabling the security filters. This ensures that Spring Security-related functionality, such as logging, session management, and CSRF protection, remains active.
Using Java configuration, we can enable access to the /login* path:
http.authorizeHttpRequests(authorizationManagerRequestMatcherRegistry ->
authorizationManagerRequestMatcherRegistry
.requestMatchers("/login*").permitAll()
);
This configuration ensures that the /login* path is accessible to everyone while keeping the security filters active. It’s particularly useful for login pages, where some Spring Security features, such as CSRF tokens, are required.
3. Disabling Security Filters With web.ignoring()
In Java configuration, we can exclude the security filter chain for specific paths, such as static resources:
web.ignoring().antMatchers("/resources/**");
This approach is useful for paths where no security processing is needed, such as serving static assets like images, CSS, and JavaScript files. However, it’s important to note that Spring Security features, such as logging or CSRF tokens, won’t be available for these paths.
4. Caveats for web.ignoring()
When using configurations like web.ignoring(), the order of definition matters. Specific paths must be defined before universal match patterns like “/**“.
More specific patterns should be defined before more general ones to ensure proper matching. If the universal pattern “/**” is defined before other patterns, it overrides them, causing the application to fail with an error:
Caused by: java.lang.IllegalArgumentException: A universal match pattern ('/**')
is defined before other patterns in the filter chain, causing them to be ignored.
Please check the ordering in your <security:http> namespace or FilterChainProxy bean configuration
at o.s.s.c.h.DefaultFilterChainValidator.checkPathOrder(DefaultFilterChainValidator.java:49)
at o.s.s.c.h.DefaultFilterChainValidator.validate(DefaultFilterChainValidator.java:39)
5. Conclusion
In this tutorial, we discussed the options for allowing access to a path using Spring Security. We explored the key differences between permitAll() and web.ignoring(), highlighting their use cases and scenarios where each approach is most suitable.
The code backing this article is available on GitHub. Once you're
logged in as a Baeldung Pro Member, start learning and coding on the project.
