title: How to turn off Spring Security in Spring Boot Application
body: <p>I have implemented authentication in my Spring Boot Application with Spring Security. </p>
  
  <p>The main class controlling authentication should be websecurityconfig:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @PropertySource(value = { "classpath:/config/application.properties" })
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
  
      @Autowired
      private RestAuthenticationSuccessHandler authenticationSuccessHandler;
      @Autowired
      private RestAuthenticationEntryPoint restAuthenticationEntryPoint;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
            .httpBasic()
              .and()
              .csrf().disable()
              .sessionManagement().sessionCreationPolicy(
                      SessionCreationPolicy.STATELESS)
              .and()
              .exceptionHandling()
              .authenticationEntryPoint(restAuthenticationEntryPoint)
              .and()
              .authorizeRequests()
                  .antMatchers("/").permitAll()
                  .antMatchers("/login").permitAll()
                  .antMatchers("/logout").permitAll()
                  .antMatchers("/ristore/**").authenticated()
                  .anyRequest().authenticated()
                  .and()
              .formLogin()
                  .successHandler(authenticationSuccessHandler)
                  .failureHandler(new SimpleUrlAuthenticationFailureHandler());
      }
  </code></pre>
  
  <p>Since I am doing OAuth, I have <code>AuthServerConfig</code> and <code>ResourceServerConfig</code> as well. My main application class looks like this:</p>
  
  <pre><code>@SpringBootApplication
  @EnableSpringDataWebSupport
  @EntityScan({"org.mdacc.ristore.fm.models"}) 
  public class RistoreWebApplication extends SpringBootServletInitializer
  {
     @Bean
      public WebMvcConfigurer corsConfigurer() {
          return new WebMvcConfigurerAdapter() {
              @Override
              public void addCorsMappings(CorsRegistry registry) {
                  registry.addMapping("/**").allowedOrigins("*");
              }
          };
      }
      public static void main( String[] args )
      {
          SpringApplication.run(RistoreWebApplication.class, args);
      }
  
      protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
           return application.sources(RistoreWebApplication.class);
       }
  }
  </code></pre>
  
  <p>Since we are doing code consolidation, we need to turn off authentication temporarily. However, I tried the following methods and nothing seems to work. I am still getting 401 when I hit these rest api urls.</p>
  
  <ol>
  <li><p>Comment out all the annotations in classes related to security including <code>@Configuration</code>, <code>@EnableWebSecurity</code>. In <a href="https://stackoverflow.com/questions/23894010/spring-boot-security-disable-security">Spring boot Security Disable security</a>, it was suggested at the bottom adding <code>@EnableWebSecurity</code> will DISABLE auth which I don't think make any sense. Tried it anyway, did not work.</p></li>
  <li><p>Modify websecurityconfig by removing all the security stuff and only do 
           <code>http
              .authorizeRequests()
              .anyRequest().permitAll();</code></p></li>
  </ol>
  
  <p><a href="https://stackoverflow.com/questions/25639188/disable-basic-authentication-while-using-spring-security-java-configuration">Disable Basic Authentication while using Spring Security Java configuration</a>.   Does not help either.</p>
  
  <ol start="3">
  <li><p>Remove security auto config</p>
  
  <p>@EnableAutoConfiguration(exclude = {
      org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class,
      org.springframework.boot.actuate.autoconfigure.ManagementSecurityAutoConfiguration.class})</p></li>
  </ol>
  
  <p>like what they did in <a href="https://stackoverflow.com/questions/36280181/disabling-spring-security-in-spring-boot-app">disabling spring security in spring boot app</a>. However I think this feature only works with <code>spring-boot-actuator</code> which I don't have. So didn't try this.</p>
  
  <p>What is the correct way disable spring security?</p>