Here is how I ended up solving the problem. Here is an example of how my security config looked in Spring Boot 1.5.x. Security was disabled with property security.basic.enabled=false
:
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/upload/**");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable().authorizeRequests()
.anyRequest().authenticated()
.and().httpBasic();
}
}
Since security.basic.enabled
was removed in Spring Boot 2 (but still reserved as property name), I ended up using security.enabled
as a custom property. Here's an example of how my config looks in Spring Boot 2:
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Value("${security.enabled:true}")
private boolean securityEnabled;
@Override
public void configure(WebSecurity web) throws Exception {
if (securityEnabled)
web.ignoring().antMatchers("/upload/**");
else
web.ignoring().antMatchers("/**");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
if (securityEnabled)
http.csrf().disable().authorizeRequests()
.anyRequest().authenticated()
.and().httpBasic();
}
}