spring security webSecurity.ignoring() -

i using spring security via spring boot. have 2 kinds of rest services.

public/** --> every 1 can access , use these services

secure/** --> authenticated users can use.

@slf4j @configuration @enablewebsecurity public class websecurityconfig extends websecurityconfigureradapter {  @override public void configure(websecurity websecurity) throws exception {     websecurity.ignoring().antmatchers("/public/**"); }  @override protected void configure(httpsecurity http) throws exception {      http.addfilterbefore(requestheaderauthenticationfilter(authenticationmanager()),             basicauthenticationfilter.class)             .authorizerequests().antmatchers("/secure/**").fullyauthenticated(); }  @bean public requestheaderauthenticationfilter requestheaderauthenticationfilter(         final authenticationmanager authenticationmanager) {      requestheaderauthenticationfilter filter = new requestheaderauthenticationfilter();     filter.setauthenticationmanager(authenticationmanager);     filter.setexceptionifheadermissing(true);     filter.setprincipalrequestheader("my_header");     filter.setinvalidatesessiononprincipalchange(true);     filter.setcheckforprincipalchanges(false);     filter.setcontinuefilterchainonunsuccessfulauthentication(false);     return filter; } 

when want access resource under public got exception.

exception: "org.springframework.security.web.authentication.preauth.preauthenticatedcredentialsnotfoundexception"

message: "my_header header not found in request."

why filter activated under public resource while configured ignored resource?

thanks advance

this issue in websecurity.ignoring() discussed in spring security github when using beans filters.

you can work around removing @bean annotation in filter declaration.

// @bean - remove or comment public requestheaderauthenticationfilter requestheaderauthenticationfilter(         final authenticationmanager authenticationmanager) {      requestheaderauthenticationfilter filter = new requestheaderauthenticationfilter();     filter.setauthenticationmanager(authenticationmanager);     filter.setexceptionifheadermissing(true);     filter.setprincipalrequestheader("my_header");     filter.setinvalidatesessiononprincipalchange(true);     filter.setcheckforprincipalchanges(false);     filter.setcontinuefilterchainonunsuccessfulauthentication(false);     return filter; }