title: Confusion around Spring Security anonymous access using Java Config
body: <p>I am using the following Java Config with Spring Security:</p>
  
  <pre><code>protected void configure(HttpSecurity http) throws Exception {
      http
          .authorizeRequests()
              .anyRequest().authenticated()
              .and()
          .httpBasic();
  }
  </code></pre>
  
  <p>Based on this configuration, all requests are authenticated.  When you hit a controller without being authenticated, the <code>AnonymousAuthenticationFilter</code> will create an Authentication object for you with <code>username=anonymousUser, role=ROLE_ANONYMOUS</code>.</p>
  
  <p>I am trying to provide anonymous access to a a specific controller method and have tried to use each of the following:</p>
  
  <ol>
  <li><code>@Secured("ROLE_ANONYMOUS")</code></li>
  <li><code>@Secured("IS_AUTHENTICATED_ANONYMOUSLY")</code></li>
  </ol>
  
  <p>When the controller methods get invoked, the following response is given:
  "HTTP Status 401 - Full authentication is required to access this resource"</p>
  
  <p>Can someone help me understand why we are receiving this message and why <code>ROLE_ANONYMOUS</code>/<code>IS_AUTHENTICATED_ANONYMOUSLY</code> don't seem to work using this configuration?</p>
  
  <p>Thanks,<br>
  JP</p>