Springboot version – 3.1.10, spring security version – 6.1.8

@Conifguration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig(){

  @Bean
  SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

   http.authorizeHttpRequests(r -> r.requestMatchers("/actuator/*").permitAll().anyRequest().authenticated());

   http.addFilterBefore(bean of some jwtFilter here, UsernamePasswordAuthenticationFilter.class);

return http.build();

   }
 }

Earlier with spring security 5 version, it used to work with

http.anyRequest().authenticated()
and
web.ignoring("antMatchers")

but the web.ignoring mechanism has been deprecated in spring security 6+ versions and is not working as well, if we put that into action.

/actuator/health let’s say if I hit then it will go inside that jwtFilter bean, that shall have not happened ideally. Without adding any custom filter,it works.

How to fix it, any ideas ?