title: SecurityFilterChain .anyRequest().permitAll() doesn't allow POST requests
body: <p>Using Spring Boot 2.7 (Spring Security 5.7.1) and trying to configure an API as a resource server and OAuth2 client I find a behavior I don't get to understand:</p>
  <pre><code>@EnableWebSecurity
  public class SecurityConfig {
  
      @Bean
      public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
          http
                  .authorizeHttpRequests((authorize) -&gt; authorize
                          .mvcMatchers(&quot;/swagger-ui/**&quot;, &quot;/api-docs/**&quot;).permitAll()
                          .anyRequest().permitAll())
  
                  // register OAuth2 resource server
                  .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)
  
                  // register OAuth2 client
                  .oauth2Client(withDefaults());
  
          return http.build();
      }
  }
  </code></pre>
  <p>Checking the logs, all this filters apply</p>
  <pre><code>o.s.s.web.DefaultSecurityFilterChain     : Will secure any request with 
  
  org.springframework.security.web.session.DisableEncodeUrlFilter@320ca97c,
  org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@3c592c0c,
  org.springframework.security.web.context.SecurityContextPersistenceFilter@2b33e616,
  org.springframework.security.web.header.HeaderWriterFilter@2e9bff08,
  org.springframework.security.web.csrf.CsrfFilter@7926d092,
  org.springframework.security.web.authentication.logout.LogoutFilter@37227aa7,
  org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter@6f18445b,
  org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationFilter@42af2977,
  org.springframework.security.web.savedrequest.RequestCacheAwareFilter@79e3f444, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@1252d480,
  org.springframework.security.web.authentication.AnonymousAuthenticationFilter@3979c6e8,
  org.springframework.security.oauth2.client.web.OAuth2AuthorizationCodeGrantFilter@19faa9dc,
  org.springframework.security.web.session.SessionManagementFilter@7d3b4646,
  org.springframework.security.web.access.ExceptionTranslationFilter@6cb2d5ea,
  </code></pre>
  <p>So far, this configuration works as expected in the other APIs I'm protecting. However, in this particular one, AND not having protected any endpoint I see that:</p>
  <p>I can access any <code>GET</code> endpoint but any <code>POST</code> endpoint returns a <code>403 FORBIDDEN</code>. However, I can access them if I add a token to the request <strong>EVEN if its an expired token</strong></p>
  <p>This alone I can't understand as <code>.anyRequest().permitAll()</code> should unprotect anything, if I'm not wrong.</p>
  <p>If I comment out the line configuring the oauth2 ResourceServer</p>
  <pre><code>`// .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)`
  </code></pre>
  <p>this filter dissapears</p>
  <p><code>org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationFilter</code></p>
  <p>And can't use <code>POST</code> endpoints anymore, even with the expired token</p>
  <p>Logically, I want the API to be <code>oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)</code> so</p>
  <p>How it is I can't access POST endpoints when using <code>.anyRequest().permitAll())</code>?</p>
  <p><strong>DISCLAIMER</strong>: I know it makes no sense to declare the API as resource server if all endpoints must be public. Endpoints will be accessed by Discord callbacks and I have to figure out if I can protect them with OAuth</p>
  <p><strong>EDIT:</strong></p>
  <pre><code>server.servlet.context-path = /api
  </code></pre>
  <h2>Controller</h2>
  <pre><code>@RestController
  @RequestMapping(&quot;/slack&quot;)
  public class SlackBotController {
      @PostMapping(&quot;/test&quot;)
      public String test(@RequestBody String a) {
          return a;
      }
  
      @GetMapping(&quot;/test&quot;)
      public String testGet() {
          return &quot;OK&quot;;
      }
  }
  </code></pre>
  <h2>Request</h2>
  <pre><code>GET/POST http://localhost:8081/api/slack/test
  </code></pre>
  <h3>Request headers</h3>
  <pre><code>User-Agent: PostmanRuntime/7.29.0
  Accept: */*
  Postman-Token: f20ba7a6-26e5-47c4-a827-0596afec27b8
  Host: localhost:8081
  Accept-Encoding: gzip, deflate, br
  Connection: keep-alive
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 3
  Cookie: JSESSIONID=D1C2B2668DC130C63DDE03F30574ED5F; JSESSIONID=823D79956CFBF14F3C77C96E29F4131C
  </code></pre>
  <h3>Response headers</h3>
  <pre><code>X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Pragma: no-cache
  Expires: 0
  X-Frame-Options: DENY
  Content-Type: application/json
  Transfer-Encoding: chunked
  Date: Fri, 03 Jun 2022 12:03:00 GMT
  Keep-Alive: timeout=60
  Connection: keep-alive
  </code></pre>