I am trying to configure Spring Security and get this following error:
Caused by: java.lang.IllegalStateException: Can’t configure antMatchers after anyRequest
This is my SecurityConfig
class:
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true) public class SecurityConfig extends WebSecurityConfigurerAdapter{ @Autowired private UserDetailsService userDetailsService; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsService).passwordEncoder(encodePWD()); } @Override protected void configure(HttpSecurity http) throws Exception{ http .csrf().disable(); http .httpBasic() .and() .authorizeRequests() .antMatchers("/rest/**").permitAll() .anyRequest().authenticated() .and() .authorizeRequests() .antMatchers("/secure/**").hasAnyRole("ADMIN") .anyRequest().authenticated() .and() .formLogin() .permitAll(); http .authorizeRequests() .antMatchers("/login").permitAll(); } @Bean public BCryptPasswordEncoder encodePWD(){ return new BCryptPasswordEncoder(); } }
I already tried call httpSecurityauthorizeRequests().anyRequest().authenticated()
as mentioned here,
still didn’t work
…any suggestion would be helpfull.
Advertisement
Answer
Authenticated should come last httpSecurity.csrf().disable() .cors() .and().authorizeRequests() .antMatchers("xyz").permitAll() .antMatchers("abc") .authenticated() .and() .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);