Nsryjdtyk

I have a post endpoint to create a user. I want this endpoint to be security free.
I have achieved this in the WebSecurityConfiguration which extends WebSecurityConfigurerAdapter, with

web.ignoring().antMatchers(HttpMethod.POST, "/v1/user/create");

In my createUser method I have a check that if the username of a to-be-created user exists, then throws a UserAllreadyExistsException.

The problem is that if the username exists, instead of this exception I get the response below

{

    "error": "unauthorized",

    "error_description": "Full authentication is required to access this resource"

}

Note: if I call this endpoint with a token, then I get the exception.

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity

public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {



    @Override

    public void configure(WebSecurity web) throws Exception {

        web.ignoring().antMatchers("/v2/api-docs", "/configuration/ui", "/swagger-resources/**", "/configuration/**", "/swagger-ui.html", "/webjars/**");



        web.ignoring().antMatchers(HttpMethod.POST, "/v1/user/create");

        web.ignoring().antMatchers(HttpMethod.GET, "/v1/user/policies/language/**");

        web.ignoring().antMatchers(HttpMethod.GET, "/v1/user/privacy/language/**");

        web.ignoring().antMatchers(HttpMethod.GET, "/v1/user/packages/**");

        web.ignoring().antMatchers(HttpMethod.GET, "/v1/config/configName/**");



    }}







public class OAuth2ResourceServerConfig extends esourceServerConfigurerAdapter {



    @Autowired

    private SigningKeyConfig signingKeyConfig;





    @Override

    public void configure(ResourceServerSecurityConfigurer config) {

        config.tokenServices(tokenServices());

    }



    @Bean

    public TokenStore tokenStore() {

        return new JwtTokenStore(accessTokenConverter());

    }



    @Bean

    public JwtAccessTokenConverter accessTokenConverter() {

        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();

        converter.setSigningKey(signingKeyConfig.getJwtSigningKey());

        return converter;

    }



    @Bean

    @Primary

    public DefaultTokenServices tokenServices() {

        DefaultTokenServices defaultTokenServices = new DefaultTokenServices();

        defaultTokenServices.setTokenStore(tokenStore());

        return defaultTokenServices;

    }

}

I thought of a workaround, instead of throwing the custom exception, i used the code below

        if (userExists.isPresent()) {

        log.error(UserUtil.USER_EXISTS);

        JSONObject error = new JSONObject();

        error.put("error", UserUtil.USER_EXISTS);

        return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(error.toString());

    }