title: InvalidTokenException for "unsecured" routes in Spring Security
body: <p>Since I have updated Spring Boot Version to 2.6.7 I get logs that the way I define unsecured routes is not recommended anymore.</p>
  <p>Log message:</p>
  <pre><code>You are asking Spring Security to ignore Ant [pattern='/actuator/**']. This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.
  </code></pre>
  <p>The way I was describing the config that Spring Security has to ignore these patterns was done by defining a WebSecurityConfiguration and ignoring those routes. What happens in this case is, that the whole security chain is skipped and the above mentioned logs are written. It's okay for me, but not for Spring ;).</p>
  <pre><code>@Configuration
  public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      public void configure(WebSecurity web) throws Exception {
          web.ignoring()
                  .antMatchers(
                         &quot;/actuator/**&quot;
                  );
      }
  }
  </code></pre>
  <p>When defining these route as part of the httpSecurity as mentioned in the log. The problem occurs that an expired/invalid token cause an error (401 unauthorized) as well for unsecured routes like <code>/actuator/health</code>.</p>
  <pre><code>@Configuration
  @EnableResourceServer
  public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
  
      @Getter
      private String[] unsecuredPathList;
  
      @PostConstruct
      public void postConstruct() {
          this.unsecuredPathList = new String[] {
                  &quot;/actuator/**&quot;};
      }
  
      @Bean
      public JwtTokenStore jwtTokenStore() {
          return new JwtTokenStore(new CustomJwtAccessTokenConverter(true));
      }
  
      @Override
      public void configure(ResourceServerSecurityConfigurer resourceServer) throws Exception {
          resourceServer.tokenStore(jwtTokenStore());
          resourceServer.tokenExtractor(new SessionCookieTokenExtractor());
      }
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
  
          http
              .anonymous()
              .authorities(&quot;ANONYMOUS&quot;)
              .and()
              .authorizeRequests()
              .antMatchers(unsecuredPathList)
              .permitAll()
              .and()
              .authorizeRequests()
              .anyRequest()
              .authenticated();
      }
  }
  </code></pre>
  <p>The goal I want to reach is:
  For an unsecure resource the token will not be evaluated/the result is ignored and there is no 401-Unauthorized-Error.</p>
  <p>Is there anything I can do in httpSecurity?
  Or is there any other recommended way to reach that goal?</p>
  <p>Thanks in advance for your help.</p>