WebSecurityPublicConfiguration.kt

import org.springframework.context.annotation.Configuration
import org.springframework.core.annotation.Order
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter

@Order(2)
@Configuration
class WebSecurityPublicConfiguration : WebSecurityConfigurerAdapter() {
    // ResourceServerConfiguration invokes OAuth2ResourceServerConfiguration.ResourceSecurityConfigurer.configure
    // which turns on authorization for all paths.
    // So to e.g. permit-all for a given path this configuration must be run first, i.e. it must have an @Order
    // value that's lower than ResourceServerConfiguration.order.
    override fun configure(http: HttpSecurity) {
        http.anonymous().and().authorizeRequests().antMatchers("/api/public/**").permitAll()

        http.csrf().disable()

        super.configure(http)

        // Trying to do permit-all like this results in our previously working OAuth protected methods returning:
        // "status":401,"error":"Unauthorized"
    }
}