Spring security permitAll requires Authorization header

Question

I have an application that has two REST endpoints:

• GET /api/products (not secure)
• POST /api/products (secure)

For the first endpoint i don't want to send the "Authorization" header. For this, I configure the following xml:

<security:intercept-url pattern="/api/products" method="GET" access="permitAll"/>

And for the second endpoint I do want to send the "Authorization" header. So, I configure this xml:

<security:intercept-url pattern="/api/products" method="POST" access="hasRole('ROLE_ADMIN')"/>

For my surprise GET /api/products is requiring an "Authorization" header and it returns 401. And POST /api/products works very nice. I just send an "Authorization" header with a valid value and everything goes well.

I realize that using <security:intercept-url> with access="permitAll" does not disable the need of "Authorization" header, is that correct ? If so, what kind of configuration I can setup for achieve my goal ?

I am using Spring Security 4

Answer 1

You should simply remove <security:intercept-url pattern="/api/products" method="GET" access="permitAll"/> and do not specify any security configuration for /api/products GET resources.