Question:

I need to implement authorization with a specific header (say "sessionId") and secure all uri's except one.

I extended OncePerRequestFilter and implemented custom AuthenticationProvider to check if sessionId is valid (as well as custom Token class etc).

How it works now: for <strong>any</strong> uri it immediately jumps to AuthSessionAuthenticationProvider's authenticate method right after AuthSessionFilter is applied and returns 403 if header sessionId isn't specified. But I want some uri's to allow access without that header.

It all together:

config:

@Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests().antMatchers(permittedUris).permitAll() .anyRequest().authenticated() .and().exceptionHandling().accessDeniedHandler(new AuthSessionAccessDeniedHandler()) .and().addFilterBefore(new AuthSessionFilter(), BasicAuthenticationFilter.class); }

Filter:

public class AuthSessionFilter extends OncePerRequestFilter { @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { Authentication auth = new AuthSessionToken(request.getHeader("sessionId")); SecurityContextHolder.getContext().setAuthentication(auth); filterChain.doFilter(request, response); } }

Provider:

public class AuthSessionAuthenticationProvider implements AuthenticationProvider { //... @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { AuthSessionToken token = (AuthSessionToken) authentication; if (token.getSessionId() == null) { throw new AccessDeniedException("Missing header sessionId"); } AuthSessionAuthorities user = authSessionService.getUserAuthoritiesToken(token.getSessionId()); if (user == null) { throw new AccessDeniedException("Session ID invalid: " + token.getSessionId()); } token.setAuthenticatedUser(user); return token; } //... }

I found more elegant solution that was developed exactly for that purpose. It's a RequestHeaderAuthenticationFilter. And then antMatchers works as expected. The initial configuration looks like this:

@Bean @SneakyThrows public RequestHeaderAuthenticationFilter preAuthenticationFilter() { RequestHeaderAuthenticationFilter preAuthenticationFilter = new RequestHeaderAuthenticationFilter(); preAuthenticationFilter.setPrincipalRequestHeader(SESSION_ID); preAuthenticationFilter.setCredentialsRequestHeader(SESSION_ID); preAuthenticationFilter.setExceptionIfHeaderMissing(false); preAuthenticationFilter.setContinueFilterChainOnUnsuccessfulAuthentication(true); preAuthenticationFilter.setAuthenticationManager(authenticationManager()); return preAuthenticationFilter; }