title: How to ignore OncePerRequestFilter for specific apis
body: <p>I created a custom filter for token authentication <code>AuthenticationTokenFilter</code> and it is extended by <code>OncePerRequestFilter</code>. I configure some APIs as whitelist APIs in my <code>SecurityConfig</code>, for these whitelist Apis, I tried to bypass my <code>AuthenticationTokenFilter</code>.</p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  @Order(SecurityProperties.BASIC_AUTH_ORDER)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private AuthenticationTokenFilter authenticationTokenFilter;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.authorizeRequests().
              regexMatchers("^(?!/webjars/).*",
                      "^(?!/swagger-resources/).*",
                      "^(?!/swagger-ui.html).*").permitAll().
              antMatchers("/healthcheck/ping",
                      "/user" + ApiMapper.SIGN_IN_API,
                      "/user" + ApiMapper.FORGET_PASSWORD,
                      "/user" + ApiMapper.SIGN_OUT_API,
                      ApiMapper.SWAGGER_RESOURCE,
                      ApiMapper.FAVICON_ICO,
                      ApiMapper.APP_ENDPOINTS).permitAll().
              anyRequest().authenticated().
              and().
              // If user isn't authorised to access a path...
                      exceptionHandling().
              // ...redirect them to /403
                      accessDeniedPage("/403").
              and().
              anonymous().disable();
  
          http.addFilterBefore(authenticationTokenFilter, BasicAuthenticationFilter.class);
      }
  
      @Override
      public void configure(WebSecurity web) throws Exception {
  
          web.ignoring().
              regexMatchers("^(?!/webjars/).*").
              regexMatchers("^(?!/swagger-resources/).*").
              regexMatchers("^(?!/swagger-ui.html/).*").
              antMatchers("/healthcheck/ping",
              "/user" + ApiMapper.SIGN_IN_API,
              "/user" + ApiMapper.FORGET_PASSWORD,
              "/user" + ApiMapper.SIGN_OUT_API,
              ApiMapper.SWAGGER_RESOURCE + "/.*",
              ApiMapper.FAVICON_ICO,
              ApiMapper.APP_ENDPOINTS);
      }
  }
  </code></pre>
  
  <p>I found a similar answer <a href="https://stackoverflow.com/questions/52370411/springboot-bypass-onceperrequestfilter-filters">here</a> but I already ignoring at <code>WebSecurity</code> configuration. So, why I need to write the same on Filter level.</p>
  
  <p>Where I'm doing wrong or maybe I'm in the wrong context.</p>