title: Spring Security with Spring Boot: Allowing unauthenticated user access on specific endpoints when using a filter
body: <p>I'm struggling with the basics of Spring Security here.</p>
  
  <p><strong>What I wish to achieve</strong></p>
  
  <p>My system is only for REST API handling, there's a login endpoint POST on <code>/user/sign_in</code> and a few open endpoints - GET on <code>/prompt/, /prompt/{id}, /story/, /story/{id}</code>, rest everything is for authenticated users only.</p>
  
  <hr>
  
  <p>I have a custom authentication filter which I've put before the <code>BasicAuthenticationFilter</code>. I'm sharing my WebSecurityConfigurerAdapter code here</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(securedEnabled = true)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private DemoAuthenticationProvider demoAuthenticationProvider;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.authorizeRequests()
                  .antMatchers(HttpMethod.GET, "/version", "/story", "/prompt").permitAll()
                  .antMatchers(HttpMethod.POST, "/user/sign_in").permitAll()
                  .anyRequest().authenticated()
                  .and()
                  .addFilterBefore(new DemoAuthenticationFilter(), BasicAuthenticationFilter.class);
          http.csrf().disable();
      }
  
      @Override
      public void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.authenticationProvider(demoAuthenticationProvider);
      }
  }
  </code></pre>
  
  <p>For the anonymous user for the open endpoints, I'm returning a null authentication token in the filter and I'm getting </p>
  
  <blockquote>
    <p>403 Access Denied</p>
  </blockquote>
  
  <p>Why should authentication token be required when I've mentioned to permit all and not just authenticated for those end points? And how do I go about implementing it correctly?</p>