title: How to prevent Spring AuthenticationProvider to execute for static or image resources?
body: <p>I have a java web Spring Boot application with some custom Spring Sceurity configuration. When I run my app the images are executing the AuthenticationProvider and it is causing me an exception (due to the fact I do some updates when the user first logs in).</p>
  
  <p>How can I prevent the AuthenticationProvider to run when images are accessed?</p>
  
  <p>My configuration is below:</p>
  
  <pre><code>@Order(1)
  @Configuration
  @EnableWebSecurity
  public class BaseSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private AuthenticationEntryPoint restUnauthorizedEntryPoint;
  
      @Autowired
      private AccessDeniedHandler      restAccessDeniedHandler;
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          LOG.info("Ignoring resources in Spring Security");
          web.ignoring()
                  .antMatchers("/images/*")
                  .antMatchers("/app/errors/*.html");
      }
  
      @Override
      public void configure(HttpSecurity http) throws SecurityConfigException {
          try {
                http
                  .antMatcher("/api/**")
                  .authorizeRequests()
                      .accessDecisionManager(accessDecisionManager())
                      .antMatchers("/api/users/**").hasAnyRole("ADMIN")
                      .anyRequest().authenticated()
  
                  .and()
                  .exceptionHandling()
                      .authenticationEntryPoint(restUnauthorizedEntryPoint)
                      .accessDeniedHandler(restAccessDeniedHandler)
  
                  .and()
                  .addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class)
                      .csrf().csrfTokenRepository(csrfTokenRepository())
  
                  .and()
                  .headers().frameOptions().sameOrigin()
  
                  .and();
          } catch (Exception ex) {
              throw new SecurityConfigException(ex);
          }
      }
  
      @Bean
      public AffirmativeBased accessDecisionManager() {
          List&lt;AccessDecisionVoter&lt;? extends Object&gt;&gt; decisionVoters = new ArrayList&lt;&gt;();
          decisionVoters.add(new WebExpressionVoter());
          decisionVoters.add(new RoleHierarchyVoter(roleHierarchy()));
          return new AffirmativeBased(decisionVoters);
      }
  
      /**
       * Create the role hierarchy as an implementation of Spring Security {@link RoleHierarchyVoter} where the Spring
       * roles are created from a combination of {@link Module}_{@link Role}. The AccessDecisionVoter provided with Spring
       * Security expects the role names to begin with the prefix 'ROLE_'. The hierarchy is as follows:
       * &lt;p/&gt;
       * {@code ROLE_COMMON_ADMIN &gt; ROLE_COMMON_USER_ADMIN } and {@code ROLE_COMMON_ADMIN &gt; ROLE_CUSTOM_USER}
       */
      @Bean
      public RoleHierarchyImpl roleHierarchy() {
          StringBuilder h = new StringBuilder();
  
          // Common tree, root is COMMON_ADMIN
          appendIncludesRule(h, Module.COMMON, Role.ADMIN, Module.COMMON, Role.USER_ADMIN);
  
          // Custom tree, root is COMMON_ADMIN
          appendIncludesRule(h, Module.COMMON, Role.ADMIN, Module.CUSTOM, Role.USER);
  
          RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
          roleHierarchy.setHierarchy(h.toString());
          return roleHierarchy;
      }
  
      private void appendIncludesRule(StringBuilder h, Module lModule, Role lRole, Module rModule, Role rRole) {
          h.append(GrantedAuthorityFactory.ROLE_PREFIX).append(lModule).append('_').append(lRole).append('&gt;');
          h.append(GrantedAuthorityFactory.ROLE_PREFIX).append(rModule).append('_').append(rRole).append(' ');
      }
  
      /**
       * Creates a replacement CsrfTokenRepository for use by Spring CSRF protection. It looks for a header called
       * X-XSRF-TOKEN, which AngularJS sets by default. AngularJS obtains this from the XSRF-TOKEN cookie (set in
       * CsrfHeaderFilter).
       * 
       * @return CsrfTokenRepository
       */
      private CsrfTokenRepository csrfTokenRepository() {
          HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
          repository.setHeaderName(CSRF_HEADER_NAME);
          return repository;
      }
  }
  </code></pre>
  
  <p>And the second configuration class:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  @Profile({ "prod" })
  public class UidSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private UserAccountService  userAccountService;
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          LOG.info("Ignoring resources in Spring Security");
          web.ignoring()
                  .antMatchers("/images/*")
                  .antMatchers("/app/errors/*.html");
      }
  
      @Override
      public void configure(AuthenticationManagerBuilder auth) {
          LOG.info("AuthenticationManagerBuilder: PreAuthenticatedAuthenticationProvider configured");
          auth.authenticationProvider(preauthAuthProvider());
      }
  
      @Override
      public void configure(HttpSecurity http) throws SecurityConfigException {
          try {
              http.addFilterBefore(ssoFilter(), RequestHeaderAuthenticationFilter.class);
              http.headers().cacheControl().disable();
          } catch (SecurityConfigException ex) {
              LOG.error("SecurityConfigException:", ex);
              throw ex;
          } catch (Exception ex) {
              LOG.error("SecurityConfigException:", ex);
              throw new SecurityConfigException(ex);
          }
      }
  
      @Bean
      public PreAuthenticatedAuthenticationProvider preauthAuthProvider() {
          PreAuthenticatedAuthenticationProvider preauthAuthProvider = new PreAuthenticatedAuthenticationProvider();
          preauthAuthProvider.setPreAuthenticatedUserDetailsService(userDetailsServiceWrapper());
          return preauthAuthProvider;
      }
  
      @Bean
      public UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt; userDetailsServiceWrapper() {
          UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt; wrapper = new UserDetailsByNameServiceWrapper&lt;&gt;();
          wrapper.setUserDetailsService(userAccountService);
          return wrapper;
      }
  
      @Bean
      public SsoHeaderFilter ssoFilter() throws SecurityConfigException {
          SsoHeaderFilter filter = new SsoHeaderFilter();
          try {
              filter.setAuthenticationManager(authenticationManager());
          } catch (Exception ex) {
              LOG.error("SsoHeaderFilter Excpetion:", ex);
              throw new SecurityConfigException(ex);
          }
          return filter;
      }
  }
  </code></pre>
  
  <p>I really don't understand why AuthenticationProvider is executing for images even after I had configured Spring to ignore all /images/* pattern.</p>
  
  <p>If I F5 the home screen I don't get the exception (because the update was made the first time the user accessed the app) but the Auth provider seem to be running yet.</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>Image path: images/mylogo.png </p>