Spring security excluded path does not call controller's endpoint with Zuul Gateway - spring

Question

I would like to disable security for a specific endpoint so that I can make a call to the Controller. Unfortunately, as I perform a call, I get a 304 (I see it in Chrome's developer tools) and I am redirected to the React frontend, ignoring my controller's endpoint
#EnableWebSecurity
#Configuration
#EnableOAuth2Sso
#EnableRedisHttpSession
public class MyWebSecurityConfig extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().antMatchers("/login*").permitAll()
.and().anonymous()
.disable()
.exceptionHandling()
.defaultAuthenticationEntryPointFor(new Http401AuthenticationEntryPoint(""), new AntPathRequestMatcher("/api/ **"))
.and()
.authorizeRequests()
.anyRequest().authenticated()
.and()
.logout()
.logoutUrl("/logout")
.logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
.invalidateHttpSession(true)
.logoutSuccessUrl(ssoLogoutUrl)
.and()
.csrf()
.csrfTokenRepository(withHttpOnlyFalse());
}
}
#SpringBootApplication
#EnableZuulProxy
#EnableDiscoveryClient
#Import({AuthUserDetailService.class, GatewayWebSecurityConfig.class, VccLoginController.class})
public class GatewayApplication {
public static void main(String[] args) {
new SpringApplicationBuilder(GatewayApplication.class).run(args);
}
}
#Controller
public class LoginController {
#RequestMapping("/login")
public String login(Model model) {
return "login.html";
}
}

Answer 1

Try with something like this:
.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.antMatchers("/login/**").permitAll()
.anyRequest().authenticated();
Notice that I've allowed options request in for every endpoint (since react exploits them before POST and PUT requests) and I've changed the login path regex to /login/**.