Precondition:

Spring-boot 2.7 application deployed to the PROD environment and it allows our UI to consume messages from ActiveMQ topics through WebSocket protocol.

Currently, we allow to establish webSocket connection only by authorized users – to handle authorization we are using Spring Security 5.7:

        .authorizeRequests(request -> request
                .requestMatchers(
                        new AntPathRequestMatcher("/ws-notification/**"))
                .authenticated());

where /ws-notification path is configured to handle webSocket communication.

@Override
public void registerStompEndpoints(@Nonnull StompEndpointRegistry stompEndpointRegistry) {
    stompEndpointRegistry.addEndpoint("/ws-notification")
            .setAllowedOriginPatterns(corsDomains)
            .withSockJS();
}

What we want to do next – is to allow unauthorized users to connect to our BE via webSocket protocol and subscribe to some predefined ActiveMQ topics.

And the question is:

Do I need to introduce another endpoint like: ws-notification-public and allow everyone to access it? Or can I still use an already existing endpoint /ws-notification to handle authenticated and anonymous users?

I am not sure how I can know whether the user is authorized or not when I allow everyone to access the endpoint.