java - How to disable authentication for one service in Spring Boot? -

i have spring boot application, in of pages secured (you need log in access them) using following security configuration.

@configuration @order(securityproperties.access_override_order) class securityconfiguration extends     websecurityconfigureradapter {       @autowired     public void registerauthentication(authenticationmanagerbuilder auth) throws exception {         auth.inmemoryauthentication()             .withuser("user")             .password("myapp")             .roles("admin")             .and()             .withuser("guest")             .password("guest")             .roles("user");     }      @override     protected void configure(httpsecurity http) throws exception {         http             .httpbasic()             .and()             .authorizerequests()             .antmatchers("/index.html", "/home.html", "/login.html", "/")             .permitall()             .anyrequest().authenticated().and()             .csrf()             .csrftokenrepository(csrftokenrepository())             .and()             .addfilterafter(new csrfheaderfilter(), csrffilter.class);     }      private csrftokenrepository csrftokenrepository() {         final httpsessioncsrftokenrepository repository =             new httpsessioncsrftokenrepository();         repository.setheadername("x-xsrf-token");         return repository;     } } 

in application class, have service publicdata, want accessible without authentication (even, if user isn't logged in).

@springbootapplication @restcontroller public class myappapplication {     @requestmapping("/resource")     public map<string,object> home() {         final map<string,object> model = new hashmap<>();         model.put("id", uuid.randomuuid().tostring());         model.put("content", "hello world");         return model;     }     @requestmapping("/publicdata")     public string publicdata() {         return ...;     }     @requestmapping("/user")     public principal user(final principal user) {         return user;     }     public static void main(final string[] args) {         springapplication.run(myappapplication.class, args);     } } 

how can this?

i tried

@override protected void configure(httpsecurity http) throws exception {     http         .httpbasic()         .and()         .authorizerequests()         .antmatchers("/index.html", "/home.html", "/login.html", "/")         .permitall()         .anyrequest().authenticated().and()         .csrf()         .csrftokenrepository(csrftokenrepository())         .and()         .addfilterafter(new csrfheaderfilter(), csrffilter.class)         .and()         .authorizerequests()         .antmatchers("/publicdata").permitall(); } 

but didn't work.

you can create role permission access , grant access in methods using spring security annotation http://docs.spring.io/spring-security/site/docs/3.0.x/reference/el-access.html

of course every user need role automatically when connect in application.

<http use-expressions="true">   <intercept-url pattern="/*"       access="hasrole('admin')"/> </http> 

then in free access method

@preauthorize("hasrole('admin')") public void create(contact contact);