Spring web security limits only one page

Question

I use Spring web security, with the code below, which restricts all but the listed pages , such as resources and app.html

How can I change this to allow all pages except those that I specifically indicate?

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private UserDetailsService userDetailsService;

    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http    .authorizeRequests()
                .antMatchers("/resources/**", "/registration", "/app.html").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .logout()
                .permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
    }
}

I got the code from here: https://spring.io/blog/2013/07/03/spring-security-java-config-preview-web-security/ , but I could not see the answer to my question.

thank

Answer 1

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/mysupersecureurl/**").authenticated()
                .anyRequest().permitAll()
                .and()
                .csrf().disable();
    }

This will protect yours mysupersecureurland open another url (i.e. permitAll()).

csrf, URL-, , mysupersecureurl. , .

Answer 2

anyRequest().permitAll() /apis

antMatchers("/api/yourAPI").authenticated()

( antMatchers("/api/yourAPI").hasAuthority(AuthoritiesConstants.ADMIN) (admin )),

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private UserDetailsService userDetailsService;

    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http    .authorizeRequests()
                .anyRequest().permitAll()
                .antMatchers("/resources/**", "/registration", "/app.html").permitAll()
                .antMatchers("/api/yourAPI").authenticated()
                // or .antMatchers("/api/yourAPI").hasAuthority(AuthoritiesConstants.ADMIN)
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .logout()
                .permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
    }
}