title: Spring security 401 Unauthorized on unsecured endpoint
body: <p>I'm trying to configure Spring Security on a Spring Boot application as follows:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Autowired
  private RestAuthenticationEntryPoint unauthorizedHandler;
  
  @Bean
  public JwtAuthenticationFilter authenticationTokenFilterBean() throws Exception {
      JwtAuthenticationFilter authenticationTokenFilter = new JwtAuthenticationFilter();
      authenticationTokenFilter.setAuthenticationManager(authenticationManagerBean());
      return authenticationTokenFilter;
  }
  
  @Override
  protected void configure(HttpSecurity httpSecurity) throws Exception {
  
      //@formatter:off
       httpSecurity
        .csrf()
          .disable()
        .exceptionHandling()
          .authenticationEntryPoint(this.unauthorizedHandler)
          .and()
        .sessionManagement()
          .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
          .and()
        .authorizeRequests()
          .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
          .antMatchers("/login", "/singup", "/subscribers").permitAll()
          .anyRequest().authenticated();
  
          // Custom JWT based security filter 
      httpSecurity            
          .addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);   
  
      //@formatter:on
  
  }
  }
  </code></pre>
  
  <p>My unauthorizedHandler is:</p>
  
  <pre><code>public class RestAuthenticationEntryPoint implements AuthenticationEntryPoint {
  
  private static final Logger LOGGER = LoggerFactory.getLogger(RestAuthenticationEntryPoint.class);
  
  @Override
  public void commence(HttpServletRequest request, HttpServletResponse response,
          AuthenticationException authException) throws IOException, ServletException {
      response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
  }
  
  }
  </code></pre>
  
  <p>Finally, the REST controller for /subscribers is:</p>
  
  <pre><code>@RestController
  public class SubscriberRestController {
  
  @Autowired
  ISubscribersService subscribersService;
  
  @RequestMapping(value = RequestMappingConstants.SUBSCRIBERS, method = RequestMethod.GET)
  @ResponseBody
  public Number subscriberCount() {
  
      return subscribersService.subscribersCount();
  }
  
  @RequestMapping(value = RequestMappingConstants.SUBSCRIBERS, method = RequestMethod.POST)
  public String subscriberPost(@RequestBody SubscriberDocument subscriberDocument) {
  
      return subscribersService.subscribersInsert(subscriberDocument);
  }
  
  @RequestMapping(value = "/test", method = RequestMethod.GET)
  public String test() {
  
      return "This is a test";
  }
  
  }
  </code></pre>
  
  <p>I use postman to test endpoints and when I do a POST to "localhost:8080/subscribers",  I get:</p>
  
  <p><a href="https://i.stack.imgur.com/cOtlx.png" rel="noreferrer"><img src="https://i.stack.imgur.com/cOtlx.png" alt="Postman result"></a></p>
  
  <p>I want to have opened endpoints (/subscribers) without any security control or credentials check, endpoints for singup and login and secured endpoints for authenticated users.</p>
  
  <p>Thanks! :)</p>