title: How to bypass spring security on an authenticated endpoint for specific domain?
body: <p>I am using jwt token based spring security.
  I have an endpoint '/sample-endpoint' which requires authentication. However, I need to bypass security for this endpoint when the request comes from a specific domain called xyz.com.</p>
  <p><strong>Is it possible to do so? If so, how to do that?</strong></p>
  <p>Here is what I have so far.</p>
  <p>SecurityConfig</p>
  <pre><code>@Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  // cant add the end point here as it would open up for everybody.
  public static final String[] unauthedUrls = { &quot;healthcheck&quot;,&quot;some-other-endpoint&quot;}  
  
  @Override
      protected void configure(HttpSecurity http) throws Exception {
          
          http
                  .httpBasic()
                  .disable()
                  .csrf()
                  .disable()
                  .cors()
                  .and()
                  .headers().frameOptions()
                  .disable()
                  .and()
                  .sessionManagement()
                  .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                  .and()
                  .exceptionHandling()
                  .authenticationEntryPoint(jwtAuthenticationEntryPoint)
                  .and()
                  .addFilterAfter(jwtSecurityFilter, UsernamePasswordAuthenticationFilter.class)
                  .authorizeRequests()
                  .antMatchers(unauthedUrls)
                  .permitAll()
                  .anyRequest()
                  .authenticated();
      }
  </code></pre>
  <p>Here is JwtSecurityFilter implementation.</p>
  <pre><code>public class JwtSecurityFilter extends OncePerRequestFilter {
  
      private static final Logger LOGGER = LoggerFactory.getLogger(JwtSecurityFilter.class);
  
      private static final String JWT_PREFIX = &quot;Bearer &quot;;
  
      @Override
      protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
              throws ServletException, IOException {
          setAuthenticationContext(request);
  
          chain.doFilter(request, response);
      }
  
      private void setAuthenticationContext(HttpServletRequest request) {
          try {
              String token = getJwt(request);
  
              if (StringUtils.isBlank(token)) {
                  throw new RuntimeException(&quot;Authorization token not provided&quot;);
              }
  
   
  
  // some logic here...
          } catch (Exception ex) {
        
              if (request != null &amp;&amp; Arrays.stream(SecurityConfig.unauthedUrls).anyMatch(url -&gt; request.getRequestURI().contains(url))) {
                  // it's a URL that isn't authenticated so an exception here is normal
                  // if we couldn't get a token
                  return;
              }
              LOGGER.warn(&quot;Unable to authenticate request: {} {}&quot;, ex.getMessage(), request == null ? null : request.getRequestURI());
          }
      }
  
      private String getJwt(HttpServletRequest request) {
  
          String authHeader = request.getHeader(HttpHeaders.AUTHORIZATION);
  
          if (StringUtils.isBlank(authHeader) || !authHeader.startsWith(JWT_PREFIX)) {
              return &quot;&quot;;
          }
  
          return authHeader.replaceFirst(Pattern.quote(JWT_PREFIX), &quot;&quot;);
      }
  }
  
  
  </code></pre>