title: Spring Boot Security Anonymous authorization
body: <p>For multiple purposes I need to use</p>
  
  <pre><code>SecurityContextHolder.getContext().getAuthentication()
  </code></pre>
  
  <p>methods in my controllers/services.</p>
  
  <p>I did migrate my app to Spring Boot 1.4.1 from XML configured Spring MVC app (now only Java configs), similar approach worked before.</p>
  
  <p>I have a problem calling <code>SecurityContextHolder.getContext().getAuthentication()</code>, for example in this controller:</p>
  
  <pre><code>@RestController
  @Secured("IS_AUTHENTICATED_ANONYMOUSLY")
  @RequestMapping("utils")
  public class UtilsController {
      @RequestMapping(value = "/check_auth", method = RequestMethod.GET)
      public Boolean getAuthState() throws SQLException {
          if (SecurityContextHolder.getContext().getAuthentication() == null){
              logger.info("Auth obj null");
          }
  
          if (SecurityContextHolder.getContext().getAuthentication().getName() != null &amp;&amp;  SecurityContextHolder.getContext().getAuthentication().getName() != "anonymousUser") {
              return true;
          } else return false;
      }
  }
  </code></pre>
  
  <p>it always returns <code>null</code>. Can't figure out why anonymous authentication is not working.</p>
  
  <p>Here is the <strong>Spring Security configuration:</strong></p>
  
  <pre><code>    @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint).and()
                  .formLogin()
                      .successHandler(ajaxSuccessHandler)
                      .failureHandler(ajaxFailureHandler)
                      .loginProcessingUrl("/authentication")
                      .passwordParameter("password")
                      .usernameParameter("username")
                      .and()
                  .logout()
                      .deleteCookies("JSESSIONID")
                      .invalidateHttpSession(true)
                      .logoutUrl("/logout")
                      .logoutSuccessUrl("/")
                      .and()
                  .csrf().disable()
                      // .anonymous().disable()
                  .authorizeRequests()
                      // .anyRequest().anonymous()
                      .antMatchers("/utils").permitAll()
                      .antMatchers("/oauth/token").permitAll()
                      .antMatchers("/admin/*").access("hasRole('ROLE_ADMIN')")
                      .antMatchers("/user/*").access("hasRole('ROLE_USER')");
      }
  </code></pre>
  
  <p>I did tried with and without <code>@Secured</code> annotation on the controller.</p>
  
  <pre><code>                .authorizeRequests()
                      // .anyRequest().anonymous()
                      .antMatchers("/utils").permitAll()
  </code></pre>
  
  <p>different variations with this settings.</p>