title: Spring Security Configuration anyRequest().authenticated() not working as expected
body: <p>My understanding of spring security's configuration <code>http.anyRequest().authenticated()</code> is that any request must be authenticated otherwise my Spring app will return a 401 response.</p>
  
  <p>Unfortunately my spring app does not behave this way, but lets unauthenticated requests pass through. </p>
  
  <p>This is my Spring Security Configuration:</p>
  
  <pre><code>@Configuration
  @Order(1)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private AuthenticationTokenFilter authenticationTokenFilter;
  
      @Autowired
      private TokenAuthenticationProvider tokenAuthenticationProvider;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .addFilterBefore(authenticationTokenFilter, BasicAuthenticationFilter.class)
                  .antMatcher("/*")
                  .authenticationProvider(tokenAuthenticationProvider)
                  .authorizeRequests()
                  .anyRequest().authenticated();
      }
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring()
                  .antMatchers("/index.html")
                  .antMatchers("/error")
                  .antMatchers("/swagger-ui.html")
                  .antMatchers("/swagger-resources");
      }
  }
  </code></pre>
  
  <p>The AuthenticationTokenFilter takes a JWT token from the request, checks its validity, creates an Authentication from it, and sets the authentication in the SecurityContextHolder. If no token is provided, the SecurityContextHolder.getContext().getAuthentication() remains null.</p>
  
  <p>My Controller looks like this:</p>
  
  <pre><code>@RestController
  @RequestMapping("/reports")
  @Slf4j
  public class ReportController {
  
      @RequestMapping()
      @ResponseBody
      public List&lt;String&gt; getIds() {
          log.info(SecurityContextHolder.getContext().getAuthentication());
          return Collections.emptyList();
      }
  
  }
  </code></pre>
  
  <p>When running a curl request against the endpoint without a token, I simply get a valid response:</p>
  
  <pre><code>-&gt; curl 'localhost:8080/reports/'
  []
  </code></pre>
  
  <p>When debugging, I can see that the <code>SecurityContextHolder.getContext().getAuthentication()</code> is null.</p>
  
  <p>Any ideas?</p>