title: How to configure Spring Security to allow Swagger URL to be accessed without authentication
body: <p>My project has Spring Security. 
  Main issue: Not able to access swagger URL at <a href="http://localhost:8080/api/v2/api-docs" rel="noreferrer">http://localhost:8080/api/v2/api-docs</a>. It says Missing or invalid Authorization header.</p>
  
  <p><a href="https://i.stack.imgur.com/z8Hl1.png" rel="noreferrer">Screenshot of the browser window</a>
  My pom.xml has the following entries</p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;io.springfox&lt;/groupId&gt;
      &lt;artifactId&gt;springfox-swagger2&lt;/artifactId&gt;
      &lt;version&gt;2.4.0&lt;/version&gt;
  &lt;/dependency&gt;
  
  &lt;dependency&gt;
      &lt;groupId&gt;io.springfox&lt;/groupId&gt;
      &lt;artifactId&gt;springfox-swagger-ui&lt;/artifactId&gt;
      &lt;version&gt;2.4.0&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>SwaggerConfig :</p>
  
  <pre><code>@Configuration
  @EnableSwagger2
  public class SwaggerConfig {
  
  @Bean
  public Docket api() {
      return new Docket(DocumentationType.SWAGGER_2).select()
              .apis(RequestHandlerSelectors.any())
              .paths(PathSelectors.any())
              .build()
              .apiInfo(apiInfo());
  }
  
  private ApiInfo apiInfo() {
      ApiInfo apiInfo = new ApiInfo("My REST API", "Some custom description of API.", "API TOS", "Terms of service", "myeaddress@company.com", "License of API", "API license URL");
      return apiInfo;
  }
  </code></pre>
  
  <p>AppConfig:</p>
  
  <pre><code>@Configuration
  @EnableWebMvc
  @ComponentScan(basePackages = { "com.musigma.esp2" })
  @Import(SwaggerConfig.class)
  public class AppConfig extends WebMvcConfigurerAdapter {
  
  // ========= Overrides ===========
  
  @Override
  public void addInterceptors(InterceptorRegistry registry) {
      registry.addInterceptor(new LocaleChangeInterceptor());
  }
  
  @Override
  public void addResourceHandlers(ResourceHandlerRegistry registry) {
      registry.addResourceHandler("swagger-ui.html")
        .addResourceLocations("classpath:/META-INF/resources/");
  
      registry.addResourceHandler("/webjars/**")
        .addResourceLocations("classpath:/META-INF/resources/webjars/");
  }
  </code></pre>
  
  <p>web.xml entries:</p>
  
  <pre><code>&lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;
          com.musigma.esp2.configuration.AppConfig
          com.musigma.esp2.configuration.WebSecurityConfiguration
          com.musigma.esp2.configuration.PersistenceConfig
          com.musigma.esp2.configuration.ACLConfig
          com.musigma.esp2.configuration.SwaggerConfig
      &lt;/param-value&gt;
  &lt;/context-param&gt;
  </code></pre>
  
  <p>WebSecurityConfig:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  @ComponentScan(basePackages = { "com.musigma.esp2.service", "com.musigma.esp2.security" })
  public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
  @Override
      protected void configure(HttpSecurity httpSecurity) throws Exception {
          httpSecurity
          .csrf()
              .disable()
          .exceptionHandling()
              .authenticationEntryPoint(this.unauthorizedHandler)
              .and()
          .sessionManagement()
              .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
              .and()
          .authorizeRequests()
              .antMatchers("/auth/login", "/auth/logout").permitAll()
              .antMatchers("/api/**").authenticated()
              .anyRequest().authenticated();
  
          // custom JSON based authentication by POST of {"username":"&lt;name&gt;","password":"&lt;password&gt;"} which sets the token header upon authentication
          httpSecurity.addFilterBefore(loginFilter(), UsernamePasswordAuthenticationFilter.class);
  
          // custom Token based authentication based on the header previously given to the client
          httpSecurity.addFilterBefore(new StatelessTokenAuthenticationFilter(tokenAuthenticationService), UsernamePasswordAuthenticationFilter.class);
      }
  }
  </code></pre>