Disable Spring Boot Security

This post will discuss how to disable security on a Spring Boot project without removing security dependency from the application.

To secure our Spring Boot application, we can add the spring-boot-starter-security dependency to pom.xml, as shown in the following example:

</dependencies>

// …

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-security</artifactId>

</dependency>

</dependencies>

If Spring Security is found on the classpath, the web browser will prompt the user to sign in. To bypass this form-based authentication, we can disable web security on our project. There are several ways to achieve this:

1. Extending WebSecurityConfigurerAdapter

The easiest way is to extend the WebSecurityConfigurerAdapter abstract class and override its configure() method such that it allows unauthenticated access to all endpoints, as shown in the following example:

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration

@EnableWebSecurity

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired

protected void configure(AuthenticationManagerBuilder auth) throws Exception {

// …

}

@Override

protected void configure(HttpSecurity httpSecurity) throws Exception {

httpSecurity.authorizeRequests().antMatchers("/").permitAll();

}

2. Excluding SecurityAutoConfiguration

We can use the exclude attribute of @SpringBootApplication to disable the SecurityAutoConfiguration auto-configuration class, as shown in the following example:

import org.springframework.boot.SpringApplication;

import org.springframework.boot.autoconfigure.SpringBootApplication;

import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;

@SpringBootApplication(exclude={SecurityAutoConfiguration.class})

public class Main

{

public static void main(String[] args) {

SpringApplication.run(Main.class, args);

}

Note that we can also control the list of auto-configuration classes to exclude by using the spring.autoconfigure.exclude property in application.properties:

1	spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration

This can also be done in the application.yml configuration file, as shown below:

spring:

autoconfigure:

exclude: org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration

That’s all about disabling Spring Boot Security.

Disable Spring Boot Security

1. Extending WebSecurityConfigurerAdapter

2. Excluding SecurityAutoConfiguration

Share this: