title: How to disable/ ignore @PreAuthorize in a Spring Boot application
body: <p>I have a Spring Boot app that provides REST APIs. All the API are secured with Spring Security. I also have added method authorization using <em>@PreAuthorize</em> annotation. </p>
  
  <p>For local development I would like to disable security altogether via a configuration or something. I want to disable both authentication and authorization so that I can easily call the APIs without having to acquire a fresh token each time I want to call the API. </p>
  
  <p>Disabling Authentication is easy, I just added this to a config method and all good. </p>
  
  <pre class="lang-java prettyprint-override"><code>@Override
  public void configure(WebSecurity web) throws Exception {
      web.ignoring().antMatchers("/api/**");
  }
  </code></pre>
  
  <p>But this causes <strong>AuthenticationCredentialsNotFoundException</strong> when hitting the endpoints that I excluded from authentication which makes sense. This exception goes away only when I remove the <em>@PreAuthorize</em> annotation which obviously I don't want to do whenever I'm about to do some local development work. It seems just by having the annotation on methods, Spring AOP kicks and checks for authentication object in Spring Security Context and there's no way to disable it rather than removing the annotations. </p>
  
  <p>How can I get Spring to ignore <em>@PreAuthorize</em> annotations altogether? I tried removing <em>@EnableGlobalMethodSecurity</em> but it didn't help with the exception. </p>