Spring Security permitAll doesn't work

Question

I am using Spring Security. I have a Controller in which some methods have to be possible to access by any user regardless if he is authenticated or not, some methods have to be possible to access only to users who are authenticated with a JWT token. I have configured some paterns with acces="permitAll()" but it seems not to work. If I try to access localhost:8080/name-of-the-app/services/public/whatever I get 401 which I return in my MobileJWTAuthenticationEntryPoint.commence method. Can you help me?

This is my context.xml:

<security:global-method-security pre-post-annotations="enabled"/>

<security:http entry-point-ref="mobileJWTAuthenticationEntryPoint"
               authentication-manager-ref="mobileJWTAuthenticationManager"
               create-session="stateless"
               use-expressions="true">
    <security:custom-filter ref="mobileJWTAuthenticationFilter" position="FORM_LOGIN_FILTER" />
    <security:intercept-url pattern="/services/public/**" access="permitAll()"/>
    <security:intercept-url pattern="/services/restAPI/**" access="isAuthenticated()" />
</security:http>

<bean id="mobileJWTAuthenticationEntryPoint" class="co.amleto.server.services.security.MobileJWTAuthenticationEntryPoint"/>

<bean id="mobileJWTAuthenticationFilter" class="co.amleto.server.services.security.MobileJWTAuthenticationFilter" >
    <constructor-arg name="authenticationManager" ref="mobileJWTAuthenticationManager"/>
    <constructor-arg name="entryPoint" ref="mobileJWTAuthenticationEntryPoint"/>
</bean>

<bean id="mobileJWTAuthenticationProvider" class="co.amleto.server.services.security.MobileJWTAuthenticationProvider"/>

<security:authentication-manager alias="mobileJWTAuthenticationManager">
    <security:authentication-provider ref="mobileJWTAuthenticationProvider"/>
</security:authentication-manager>

EDIT: My whole code is inspired by this: http://massimilianosciacco.com/spring-security-jwt-authentication. In the AuthenticationFilter I've switched throws with returns. Now I get blank page regardless which url I hit.

I think that you are using a configuration of an old version of Spring Security. try to use access="IS_AUTHENTICATED_ANONYMOUSLY"and for the authenticated users put the ROLE_USER. try to read more the user guide — Spartan
this section will explain to you the differance between the version 3.2.x and 4.x: docs.spring.io/spring-security/site/migrate/current/3-to-4/…. — Spartan

Jacek Jacek · Accepted Answer · 2015-11-15T21:19:10

Problem solved. As I've mentioned in the edit, my code is based on the solution from the link added in the OP. Custom filter had wrong code: in every situation exceptions were thrown. The solution was to invoke chain.doFilter(request, response) and return from the doFilter method to allow anonymous url invocation.

Spring Security permitAll doesn't work

1 Answers