title: How to disable DefaultSecurityFilterChain in a Spring Boot app?
body: <p>In my Spring Boot application, I have:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      ...
      @Override
      protected void configure(HttpSecurity httpSecurity)
          throws Exception 
      {
          httpSecurity
              .authorizeRequests()
              // various GET/POST path enable rules, none of which would enable access to default ones (see log below)
              ...
              // finally, deny everything else
              .antMatchers("/**").denyAll()
              ...
      }
  }
  </code></pre>
  
  <p>At startup, the log shows:</p>
  
  <pre><code>2016-01-29 13:20:49.379  INFO 8044 --- [ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain     : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/css/**'], Ant [pattern='/js/**'], Ant [pattern='/images/**'], Ant [pattern='/**/favicon.ico'], Ant [pattern='/error']]], []
  </code></pre>
  
  <p>and I can access, for example, <code>localhost:8080/blah/favicon.ico</code> even though I would expect it to be blocked.</p>
  
  <p>I tried to follow recommendations in <a href="https://stackoverflow.com/questions/25633477/security-configuration-with-spring-boot">Security configuration with Spring-boot</a> and <a href="https://stackoverflow.com/questions/22767205/spring-security-exclude-url-patterns-in-security-annotation-configurartion">Spring Security exclude url patterns in security annotation configurartion</a>.</p>
  
  <p>Per docs at <a href="http://docs.spring.io/spring-boot/docs/current-SNAPSHOT/reference/htmlsingle/#boot-features-security" rel="nofollow noreferrer">http://docs.spring.io/spring-boot/docs/current-SNAPSHOT/reference/htmlsingle/#boot-features-security</a>, I also tried setting <code>security.ignored</code> to various paths, as well as annotating the above class with <code>@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)</code>, all to no avail.</p>
  
  <p>Is there a simple way to disable the <code>DefaultSecurityFilterChain</code> so that it does not add these ignored (insecure) paths for common static resource locations?</p>
  
  <p>If not, what is the proper configuration, either in Java or in <code>application.properties</code>, to disable these paths?</p>
  
  <hr/>
  
  <p>OK, so there are two ways to do it:</p>
  
  <p>In <code>application.properties</code>, set <code>security.ignored=none</code>.</p>
  
  <p>Or, create the following class:</p>
  
  <pre><code>@Component
  public class CustomSecurityProperties extends SecurityProperties {
      public CustomSecurityProperties() {
          // the default list is empty
          List&lt;String&gt; ignoredPaths = getIgnored();
          ignoredPaths.add("none");
      }
  }
  </code></pre>
  
  <p>A hint for the magic <code>none</code> came from lines 121-130 of <code>SpringBootWebSecurityConfiguration</code> at <a href="https://github.com/spring-projects/spring-boot/blob/master/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.java" rel="nofollow noreferrer">https://github.com/spring-projects/spring-boot/blob/master/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.java</a></p>
  
  <p>Either solution still leaves the following in the log:</p>
  
  <pre><code>2016-01-29 17:53:12.830  INFO 3008 --- [           main] o.s.w.s.handler.SimpleUrlHandlerMapping  : Mapped URL path [/**/favicon.ico] onto handler of type [class org.springframework.web.servlet.resource.ResourceHttpRequestHandler]
  </code></pre>
  
  <p>This indicates that a <code>ResourceHttpRequestHandler</code> is created to serve the <code>favicon.ico</code> file. However, <code>/blah/favicon.ico</code> can no longer be accessed.</p>