title: authentication in spring boot using graphql
body: <p>I’m working on a spring boot project with GraphQL. I'm using graphql-java-tools and graphql-spring-boot-starter. I managed to configure security and session management with spring security as you can see in the java config files below. </p>
  
  <p>Now the “/graphql” path is secured (it can be accessed only sending the “basic http authentication” or a session token (<code>x-auth-token</code>) in a http header of the request). Authenticating with “basic http authentication” on any GraphQL operation will start a new session and send back the new session token in a header, and that token can be used further to continue that session.</p>
  
  <p>How to give access to anonymous users to some GraphQL queries/mutations keeping the above behavior?</p>
  
  <p>If I change <code>antMatchers("/graphql").authenticated()</code> to <code>antMatchers("/graphql").permitAll()</code> in order to allow anonymous access, then my custom <code>AuthenticationProvider</code> is not called anymore even when I try to authenticate with “basic http authentication”.</p>
  
  <p>Thanks!</p>
  
  <p>Here are my configs:</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private AuthenticationProvider authenticationProvider;
  
      @Override
      public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) {
          authenticationManagerBuilder.authenticationProvider(authenticationProvider);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .csrf().disable()
              .authorizeRequests()
              .antMatchers("/graphql").authenticated()
              .and()
              .requestCache()
              .requestCache(new NullRequestCache())
              .and()
              .httpBasic()
              .and()
              .headers()
              .frameOptions().sameOrigin() // needed for H2 web console
              .and()
              .sessionManagement()
              .maximumSessions(1)
              .maxSessionsPreventsLogin(true)
              .sessionRegistry(sessionRegistry());
      }
  
      @Bean
      public SessionRegistry sessionRegistry() {
          return new SessionRegistryImpl();
      }
  
      @Bean
      public HttpSessionEventPublisher httpSessionEventPublisher() {
          return new HttpSessionEventPublisher();
      }
  }
  </code></pre>
  
  <pre class="lang-java prettyprint-override"><code>@EnableRedisHttpSession(maxInactiveIntervalInSeconds = 180)
  public class HttpSessionConfig {
  
      @Bean
      public HttpSessionStrategy httpSessionStrategy() {
          return new HeaderHttpSessionStrategy();
      }
  
  }
  </code></pre>