How to disable spring security for specific url only via config? - spring

Question

I have a specific application URL - https://baseurl/contextroot. It is an Angular5 app packaged within a spring boot application. I want to enable spring security for all urls except https://baseurl/contextroot/path1.
My application does not have user login.
I tried something like below, based on results from search forums. The below code does not even load my application https://baseurl/contextroot and it returns 403.
Error:
(type=Forbidden, status=403).
Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-XSRF-TOKEN'.
#Configuration
#EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
// Build the request matcher for CSFR protection
RequestMatcher csrfRequestMatcher = new RequestMatcher() {
// Disable CSFR protection on the following urls:
private AntPathRequestMatcher[] requestMatchers = { new AntPathRequestMatcher("/**/path1")
};
#Override
public boolean matches(HttpServletRequest request) {
// If the request match one url the CSFR protection will be disabled
for (AntPathRequestMatcher rm : requestMatchers) {
if (rm.matches(request)) {
return false;
}
}
return true;
} // method matches
}; // new RequestMatcher
http.headers().frameOptions().disable();
http.csrf()
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
.and()
// Disable the csrf protection on some request matches
.csrf()
.requireCsrfProtectionMatcher(csrfRequestMatcher);
return;
} // method configure
}
Also my application will be a child application, loaded in a iframe and I wanted to allow only certain urls to be load my application and I found option to add header writer but I could not get something like below to work.
http.headers().frameOptions().disable();
http.headers().addHeaderWriter(new XFrameOptionsHeaderWriter(
new WhiteListedAllowFromStrategy(Arrays.asList("allowed-website-1","allowed-website-2"))));

Answer 1

You can try doing like this.
#Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/contextroot/path1").permitAll();
}