title: Ignore Bearer Token Validation for specific Urls in Spring Boot
body: <p>I am configuring a micro service as a resource server which uses a JWK end point to validate the signature of the JWT Token.</p>
  <p>I have setup the config to permit all <code>GET</code> requests in the service. All other requests are secured based on the scope and role. Here is the config that I am using.</p>
  <pre><code>@EnableReactiveMethodSecurity
  class SecurityConfig : WebFluxConfigurer {
  
      @Bean
      fun authenticationEntryPoint(): ServerAuthenticationEntryPoint {
          return JwtBearerTokenServerAuthenticationEntryPoint()
      }
  
      @Bean
      fun accessDeniedHandler(): ServerAccessDeniedHandler {
          return JwtTokenAccessDeniedHandler()
      }
  
      @Bean
      fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
          http
              .authorizeExchange()
              .pathMatchers(HttpMethod.GET).permitAll()
              .pathMatchers(&quot;/docs/**&quot;, &quot;/v2/api-docs/**&quot;, &quot;/&quot;).permitAll()
              // Client should have the required scope to write to products
              .pathMatchers(HttpMethod.POST).hasAuthority(PRODUCT_WRITE_SCOPE)
              .pathMatchers(HttpMethod.PUT).hasAuthority(PRODUCT_WRITE_SCOPE)
              .pathMatchers(HttpMethod.DELETE).hasAuthority(PRODUCT_WRITE_SCOPE)
              // health and info urls will be open(permitted to all) others will be checked for authorization
              .matchers(EndpointRequest.to(HealthEndpoint::class.java, InfoEndpoint::class.java)).permitAll()
              .anyExchange().authenticated()
              .and()
              .csrf().disable()
              .formLogin().disable()
              .oauth2ResourceServer()
              .authenticationEntryPoint(authenticationEntryPoint())
              .accessDeniedHandler(accessDeniedHandler())
              .jwt()
              .jwtAuthenticationConverter {
                  jwtAuthenticationConverter(it)
              }
  
          return http.build()
      }
  
      private fun jwtAuthenticationConverter(jwt: Jwt): Mono&lt;AbstractAuthenticationToken&gt;? {
          val jwtAuthConverter = ReactiveJwtAuthenticationConverter()
          jwtAuthConverter.setJwtGrantedAuthoritiesConverter {
              val jwtGrantedAuthoritiesConverter = JwtAuthoritiesConverter()
              val reactiveJwtGrantedAuthoritiesConverterAdapter =
                  ReactiveJwtGrantedAuthoritiesConverterAdapter(jwtGrantedAuthoritiesConverter)
              reactiveJwtGrantedAuthoritiesConverterAdapter.convert(it)
          }
          return jwtAuthConverter.convert(jwt)
      }
  
      companion object {
          private const val PRODUCT_WRITE_SCOPE = &quot;SCOPE_product:write&quot;
      }
  
  }
  
  </code></pre>
  <p>The issue that I am facing is that if I send an expired token in the authorization header of a <code>GET</code> request, the token validation still happens and I get a token expired error.</p>
  <p>Is there a way to change the configuration in such a way that the token validation only happens for some end points and is ignored for others?</p>