title: disabling spring security in spring boot app
body: <p>I have a spring boot web app with spring security configured. I want to disable authentication for a while (until needed).</p>
  
  <p>I add this to the <code>application.properties</code>: </p>
  
  <pre><code>security.basic.enable: false   
  management.security.enabled: false  
  </code></pre>
  
  <p>Here is some part of my </p>
  
  <p>But I still have a basic security included : There is a default security password generated at startup and I am still getting HTTP Authentication prompt box. </p>
  
  <p>My pom.xml :</p>
  
  <pre><code>&lt;project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"&gt;
      &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
      &lt;groupId&gt;fr.test.sample&lt;/groupId&gt;
      &lt;artifactId&gt;navigo&lt;/artifactId&gt;
      &lt;version&gt;1.0.0-SNAPSHOT&lt;/version&gt;
  
      &lt;!-- Inherit defaults from Spring Boot --&gt;
      &lt;parent&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
          &lt;version&gt;1.3.1.RELEASE&lt;/version&gt;
      &lt;/parent&gt;
  
      &lt;properties&gt;
          &lt;java.version&gt;1.7&lt;/java.version&gt;
          &lt;jsoup.version&gt;1.8.3&lt;/jsoup.version&gt;
          &lt;guava.version&gt;18.0&lt;/guava.version&gt;
          &lt;postgresql.version&gt;9.3-1103-jdbc41&lt;/postgresql.version&gt;
      &lt;/properties&gt;
  
      &lt;!-- Add typical dependencies for a web application --&gt;
      &lt;dependencies&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-actuator&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-thymeleaf&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-mail&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework&lt;/groupId&gt;
              &lt;artifactId&gt;spring-context-support&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.apache.velocity&lt;/groupId&gt;
              &lt;artifactId&gt;velocity&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-devtools&lt;/artifactId&gt;
              &lt;optional&gt;true&lt;/optional&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.jsoup&lt;/groupId&gt;
              &lt;artifactId&gt;jsoup&lt;/artifactId&gt;
              &lt;version&gt;${jsoup.version}&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;com.google.guava&lt;/groupId&gt;
              &lt;artifactId&gt;guava&lt;/artifactId&gt;
              &lt;version&gt;${guava.version}&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-data-jpa&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.postgresql&lt;/groupId&gt;
              &lt;artifactId&gt;postgresql&lt;/artifactId&gt;
              &lt;/dependency&gt;
      &lt;/dependencies&gt;
  
      &lt;!-- Package as an executable jar --&gt;
      &lt;build&gt;
          &lt;plugins&gt;
              &lt;plugin&gt;
                  &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
                  &lt;artifactId&gt;spring-boot-maven-plugin&lt;/artifactId&gt;
              &lt;/plugin&gt;
          &lt;/plugins&gt;
      &lt;/build&gt;
  
      &lt;!-- Add Spring repositories --&gt;
      &lt;!-- (you don't need this if you are using a .RELEASE version) --&gt;
      &lt;repositories&gt;
          &lt;repository&gt;
              &lt;id&gt;spring-snapshots&lt;/id&gt;
              &lt;url&gt;http://repo.spring.io/snapshot&lt;/url&gt;
              &lt;snapshots&gt;
                  &lt;enabled&gt;true&lt;/enabled&gt;
              &lt;/snapshots&gt;
          &lt;/repository&gt;
          &lt;repository&gt;
              &lt;id&gt;spring-milestones&lt;/id&gt;
              &lt;url&gt;http://repo.spring.io/milestone&lt;/url&gt;
          &lt;/repository&gt;
      &lt;/repositories&gt;
      &lt;pluginRepositories&gt;
          &lt;pluginRepository&gt;
              &lt;id&gt;spring-snapshots&lt;/id&gt;
              &lt;url&gt;http://repo.spring.io/snapshot&lt;/url&gt;
          &lt;/pluginRepository&gt;
          &lt;pluginRepository&gt;
              &lt;id&gt;spring-milestones&lt;/id&gt;
              &lt;url&gt;http://repo.spring.io/milestone&lt;/url&gt;
          &lt;/pluginRepository&gt;
      &lt;/pluginRepositories&gt;
  
  &lt;/project&gt;
  </code></pre>
  
  <p>The security is configured in WebSecurityConfig.java (I have commented the annotation to disable it) :</p>
  
  <pre><code>//@Configuration
  //@EnableWebSecurity
  //@EnableGlobalMethodSecurity(prePostEnabled = true)
  //@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      @Autowired
      UserDetailsService userDetailsService;
  
      @Autowired
      UserService userService;
  
      @Autowired
      private DataSource datasource;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          // http.authorizeRequests().antMatchers("/bus/topologie", "/home")
          // http.authorizeRequests().anyRequest().authenticated()
          // .antMatchers("/admin/**").access("hasRole('ADMIN')").and()
          // .formLogin().failureUrl("/login?error")
          // .defaultSuccessUrl("/bus/topologie").loginPage("/login")
          // .permitAll().and().logout()
          // .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
          // .logoutSuccessUrl("/login").permitAll().and().rememberMe()
          // .rememberMeParameter("remember-me")
          // .tokenRepository(persistentTokenRepository())
          // .tokenValiditySeconds(86400).and().csrf();
      }
  
      @Bean
      public PersistentTokenRepository persistentTokenRepository() {
          JdbcTokenRepositoryImpl tokenRepositoryImpl = new JdbcTokenRepositoryImpl();
          tokenRepositoryImpl.setDataSource(datasource);
          return tokenRepositoryImpl;
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth)
              throws Exception {
  
          PasswordEncoder encoder = new BCryptPasswordEncoder();
  
          auth.userDetailsService(userDetailsService).passwordEncoder(encoder);
          auth.jdbcAuthentication().dataSource(datasource);
  
          if (!userService.userExists("user")) {
              User userAdmin = new User("user", encoder.encode("password"), true);
              Set&lt;Authorities&gt; authorities = new HashSet&lt;Authorities&gt;();
              authorities.add(new Authorities(userAdmin,"ADMIN"));
              authorities.add(new Authorities(userAdmin,"CRIP"));
              authorities.add(new Authorities(userAdmin,"USER"));
              userAdmin.setAuthorities(authorities);
  
              userService.createUser(userAdmin);
          }
      }
  
  }
  </code></pre>