title: Prevent Spring Boot from registering one of Spring Security filter
body: <p>I would like to disable one of the Spring Security filters in security chain.</p>
  <p>I have already saw <a href="https://stackoverflow.com/questions/28421966/prevent-spring-boot-from-registering-a-servlet-filter">Prevent Spring Boot from registering a servlet filter</a> question - and accepted should work but, unfortunately is not.</p>
  <p>With code:</p>
  <pre><code>    @Bean
      public FilterRegistrationBean registration(AnonymousAuthenticationFilter filter) {
          FilterRegistrationBean registration = new FilterRegistrationBean(filter);
          registration.setEnabled(false);
          return registration;
      }
  </code></pre>
  <p>Spring Boot will promptly announce there is no qualifying bean, which is sad:</p>
  <blockquote>
  <p>Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.web.authentication.AnonymousAuthenticationFilter] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}</p>
  </blockquote>
  <p>After creating another bean:</p>
  <pre><code>    @SuppressWarnings(&quot;deprecation&quot;) // Oh, there be dragons
      @Bean
      public AnonymousAuthenticationFilter anonymousAuthenticationFilter() {
          return new AnonymousAuthenticationFilter();
      }
  </code></pre>
  <p>I am attacked with</p>
  <blockquote>
  <p>Caused by: java.lang.IllegalArgumentException: [Assertion failed] - this String argument must have length; it must not be null or empty</p>
  </blockquote>
  <p>Which is entirely understable; <code>Assert</code>s in <code>afterPropertiesSet()</code> method <a href="https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/authentication/AnonymousAuthenticationFilter.java" rel="noreferrer">https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/authentication/AnonymousAuthenticationFilter.java</a> are preventing me from using default constructor. Using another approach:</p>
  <pre><code>    @Bean
      public AnonymousAuthenticationFilter anonymousAuthenticationFilter() {
          // it will be disabled anyway so...
          return new AnonymousAuthenticationFilter(&quot;_&quot;, new Object(), new ArrayList&lt;GrantedAuthority&gt;());
      }
  </code></pre>
  <p>Everything is way nicer:</p>
  <blockquote>
  <p>INFO  4916 --- [ost-startStop-1] o.s.b.c.embedded.FilterRegistrationBean  : Filter anonymousAuthenticationFilter was not registered (disabled)</p>
  <p>DEBUG 4916 --- [ost-startStop-1] o.s.security.web.FilterChainProxy        : Initializing filter 'springSecurityFilterChain'</p>
  <p>DEBUG 4916 --- [ost-startStop-1] o.s.security.web.FilterChainProxy        : Filter 'springSecurityFilterChain' configured successfully</p>
  </blockquote>
  <p>But after accessing some resource I got:</p>
  <blockquote>
  <p>DEBUG 4916 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /user at position 10 of 13 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'</p>
  <p>DEBUG 4916 --- [nio-8080-exec-3] o.s.s.w.a.AnonymousAuthenticationFilter  : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@90572420: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@255f8: RemoteIpAddress: 127.0.0.1; SessionId: 6B9D974A4634548750FE78C18F62A6B0; Granted Authorities: ROLE_ANONYMOUS'</p>
  </blockquote>
  <p>For some reason AnonymousAuthenticationFilter is still working.
  The question: Is there a way to disable such filters in Spring Boot application?</p>