Deny resource without ROLE in spring - spring

Question

I am not able to deny (403) the resources that are without rules
When I try to access the resource / app1 / b it is not being denied
I'm not wondering where the problem is
CLASS WebSecurityConfiguration
#Configuration
#EnableWebSecurity
#EnableGlobalMethodSecurity(prePostEnabled = true, jsr250Enabled = true)
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
#Autowired
private AwsCognitoJwtAuthenticationFilter awsCognitoJwtAuthenticationFilter;
#Autowired
private JwtAuthenticationEntryPoint authenticationEntryPoint;
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/signin", "/signup")
.permitAll()
.anyRequest()
.authenticated().and()
.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint).and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(awsCognitoJwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
}
}
CLASS AwsCognitoJwtAuthenticationFilter
#Slf4j
public class AwsCognitoJwtAuthenticationFilter extends OncePerRequestFilter {
#Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
Authentication authentication;
try {
authentication = getAuthentication(request);
SecurityContextHolder.getContext().setAuthentication(authentication);
} catch (ForbiddenException e) {
SecurityContextHolder.clearContext();
log.error(e.getMessage());
handleUnauthorizedResponse(response, HttpStatus.FORBIDDEN, e);
return;
} catch (Exception e) {
SecurityContextHolder.clearContext();
log.error(e.getMessage());
handleUnauthorizedResponse(response, HttpStatus.UNAUTHORIZED, e);
return;
}
filterChain.doFilter(request, response);
}
.
.
.
}
CLASS AppResource
The resource "/app1/b" is not being denied
#RestController
#RequestMapping("/app1")
public class AppResource {
#GetMapping
#RolesAllowed({"ROLE_ADMIN"})
public Map all() {
return Collections.singletonMap("nome", "Mauricio");
}
#GetMapping("/a")
#RolesAllowed("XXS")
public Map all2() {
return Collections.singletonMap("nome", "XXX");
}
#GetMapping("/b")
public Map noAuth() {
return Collections.singletonMap("nome", "no auth");
}
}

Answer 1

This seems like expected behavior.
.anyRequest()
.authenticated()
These two lines allow access to any of your endpoints, as long as the user is authenticated.
What other behavior would you like?