Spring Boot指定Profile中禁用Security

1. Overview

In this tutorial, we’re going to take a look at how we can disable Spring Security for a given profile.

2. Configuration

First of all, let’s define a security configuration that simply allows all requests.

We can achieve this by registering a WebSecurityCustomizer bean and ignoring requests for all paths:

@Configuration
public class ApplicationNoSecurity {

    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return (web) -> web.ignoring()
            .requestMatchers(new AntPathRequestMatcher("/**"));
    }
}

Remember that this shuts off not only authentication but also any security protections like XSS.

3. Specify Profile

Now we want to activate this configuration only for a given profile.

Let’s assume we have a unit test suite where we don’t want security. If this test suite runs with a profile named “test”, we can annotate our configuration with @Profile:

@Configuration
@Profile("test")
public class ApplicationNoSecurity {

    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return (web) -> web.ignoring()
            .requestMatchers(new AntPathRequestMatcher("/**"));
    }
}

Consequently, our test environment will differ, which we may not want. Alternatively, we can leave security on and use Spring Security’s test support.

4. Conclusion

In this tutorial, we illustrated how to disable Spring Security for a specific profile.

As always, the complete source code is available over on GitHub.