title: Spring-Boot REST service basic http auth exclude one endpoint
body: <p>I have a REST-only micro service built on Spring-Boot version 1.5.4.RELEASE with spring-boot-starter-security. The service has no web pages, just JSON in and out. The username and password are configured in the application.properties file. With credit to <a href="http://ryanjbaxter.com/2015/01/06/securing-rest-apis-with-spring-boot/" rel="noreferrer">http://ryanjbaxter.com/2015/01/06/securing-rest-apis-with-spring-boot/</a> the following configuration causes the server to implement basic HTTP authentication quite nicely, it accepts the credentials and rejects unauthorized requests:</p>
  
  <pre><code>import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  
  @Configuration
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable().authorizeRequests() //
                  .anyRequest().authenticated().and().httpBasic();        
      }
  }
  </code></pre>
  
  <p>My question is that I'd like to exclude one little ole path, one tiny endpoint, from basic HTTP authentication.  From frantic googling and SO copy-pasting I revised the above to have this:</p>
  
  <pre><code>    http.csrf().disable().authorizeRequests() //
          .antMatchers("/healthcheck").permitAll()
          .anyRequest().authenticated().and().httpBasic();
  </code></pre>
  
  <p>This compiles and runs without warning, but that path is not opened for unauthenticated access.  I still must supply credentials to check the service health.</p>
  
  <p>Do I have to match paths one by one? My little healthcheck endpoint is at the base of the context path, as are a whole bunch of others - adding paths one-by-one would be a hassle.</p>
  
  <p>The relevant part of my application.properties file is:</p>
  
  <pre><code>security.user.name = web-user
  security.user.password = web-pass
  management.security.roles=SUPERUSER
  </code></pre>
  
  <p>Maybe I need to fiddle roles somehow?  </p>
  
  <p>Please help, thanks in advance.</p>
  
  <p>Update 1: </p>
  
  <p>Path information - I'd like this path (and many more at root) to be guarded:</p>
  
  <pre><code>localhost:8081/abcd/user
  </code></pre>
  
  <p>And I'd like ONLY this one path to be open, no auth required:</p>
  
  <pre><code>localhost:8081/abcd/healthcheck
  </code></pre>
  
  <p>Update 2: Looks like I largely duplicated this 3-year-old question, but no answer was accepted there for my issue:</p>
  
  <p><a href="https://stackoverflow.com/questions/24658285/spring-boot-setup-basic-auth-on-a-single-web-app-path?rq=1">spring-boot setup basic auth on a single web app path?</a></p>