I'm trying to design an application that should expose two global API path:

* `/` user must be authenticated
* `/public` no authentication

Moreover `/public` API will offer light version of some `/` API by displaying less informations that is not authorize if no authentication is provided.

Even if `Controller` does not contains core function, some of them provide data validation or other check. Thus if I want to create a `/public` version of a current API I have 4 solutions:

1. Duplicate code
2. `@Autowired` `/` controller and use method call
3. `forward` request (I can't `redirect` because security filter will be applied)
4. Create `Controller` that manage both `/` and `/public` API

Is there any good practice or pattern for my scenario?