Guide to Disable Spring Security

1. Overview

Spring Security is a powerful, highly customizable authentication and access-control framework for Java applications. We’ll outline the purpose of Spring Security and some common scenarios where disabling it might be necessary, such as during development, testing, or when using a custom security mechanism.

This article will guide us through the steps to disable Spring Security in a Spring Boot application while ensuring that the configurations are easy to manage and revert. We’ll also provide here code samples that we can refer to in our projects, complete with unit tests to demonstrate their behavior. In this tutorial, we’ll discuss the basic concepts necessary for understanding how to disable Spring Security in a Spring Boot application.

2. Disabling Spring Security

Depending on our application’s specific requirements, we can disable Spring Security in several ways. We’ll explore four common methods:

• using a custom security configuration
• leveraging Spring profiles
• removing Spring Security Dependency
• excluding Spring Security auto-configuration

Before we discuss the different strategies for disabling Spring Security, let’s set up a simple Spring Boot application through Spring Initializr that we’ll use throughout the guide. We’ll create a minimal Maven-based Spring Boot project with a single controller that will serve as our test endpoint:

@RestController
@RequestMapping("/api")
public class PublicController {
    @GetMapping("/endpoint")
    public ResponseEntity<String> publicEndpoint() {
        return ResponseEntity.ok("This is a public endpoint.");
    }
}

3. Using a Custom Security Configuration

One of the most straightforward ways to disable Spring Security is by creating a custom security configuration class. This method involves defining and configuring a SecurityFilterChain bean to allow all requests without authentication:

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
      .csrf(AbstractHttpConfigurer::disable);
    return http.build();
}

4. Leveraging Spring Profiles

Spring profiles allow us to configure different environments for our application. We can use profiles to disable security in certain environments, such as development or testing. Create a new profile-specific properties file, for example, application-dev.properties, and add the following line:

server.port= 8080
spring.profiles.active=dev
spring.application.name=spring-security-noauth-profile

@Profile("dev")
public class DevSecurityConfiguration {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
        return http.build();
    }
}

Along with the above configuration, we’ll define another security configuration class that applies when the dev profile is not active. This configuration enables authentication and allows restricted access to all endpoints:

@Profile("!dev")
public class SecurityConfiguration {
    @Bean
    SecurityFilterChain httpSecurity(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
          .formLogin(withDefaults())
          .httpBasic(withDefaults());
        return http.build();
    }
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <version>...</version>
</dependency>

spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration

We can programmatically verify that security is disabled by writing JUnit tests using the MockMvc library.

public class CommonSecurityConfigTest {
    @Autowired
    private MockMvc mockMvc;
    @Test
    public void whenSecurityIsDisabled_thenAllEndpointsAreAccessible() throws Exception {
        mockMvc.perform(get("/api/endpoint"))
          .andExpect(status().isOk());
    }
}

@ActiveProfiles("dev")
public class DevProfileSecurityConfigTest {
    @Autowired
    private MockMvc mockMvc;
    @Test
    public void whenDevProfileIsActive_thenAccessIsAllowed() throws Exception {
        mockMvc.perform(get("/api/endpoint"))
          .andExpect(status().isOk());
    }
}

public class NonDevProfileSecurityConfigTest {
    @Autowired
    private MockMvc mockMvc;
    @Test
    public void whenNonDevProfileIsActive_thenAccessIsDenied() throws Exception {
        mockMvc.perform(get("/api/endpoint"))
          .andExpect(status().isUnauthorized());
    }
}

8. Conclusion

In this article, we discussed various methods for disabling Spring Security in a Spring Boot application, each suited for different scenarios. Whether we use a custom security configuration or leverage Spring profiles, the approach should align with our development and deployment needs. By following the steps outlined in this article, we can ensure that our application remains flexible and easy to manage, especially during the development and testing phases.

Always remember to re-enable security in production environments to maintain the integrity and safety of our application. As always, the code for these examples is available over on GitHub.