I want to build a authentication system by Bearer Token. There’s some methods that I want to be accessible without being authenticate, but when I was stating to build can’t make this work, It always return 401 Unauthorized and a json. I’m using Spring Boot 3.3.0 with Java 21.

JSON that I receive:

{
    "timestamp": "2024-07-28T14:12:45.187+00:00",
    "status": 401,
    "error": "Unauthorized",
    "message": "Unauthorized",
    "path": "/api"
}

SecurityConfig.java

package com.espacogeek.geek.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(securedEnabled = true)
public class SecurityConfig {

    @Bean
    public SecurityFilterChain configure(HttpSecurity http) throws Exception {
        return http.csrf(csrf -> csrf.disable())
                    .authorizeHttpRequests(auth -> {
                        auth.anyRequest().authenticated();
                    })
                    .sessionManagement(
                            session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                    .httpBasic(withDefaults())
                    .build();
    }
}

I already tried change auth.anyRequest().authenticated() to auth.anyRequest().anonymous() and auth.anyRequest().permitAll(), but the result are the same.

MediaController.java

package com.espacogeek.geek.controllers;

import java.time.LocalDate;
import java.time.ZoneId;
import java.time.temporal.ChronoUnit;
import java.util.ArrayList;
import java.util.List;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.graphql.data.method.annotation.Argument;
import org.springframework.graphql.data.method.annotation.QueryMapping;
import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.stereotype.Controller;

import com.espacogeek.geek.data.MediaDataController;
import com.espacogeek.geek.models.MediaModel;
import com.espacogeek.geek.services.MediaService;

import jakarta.annotation.security.PermitAll;

@Controller
public class MediaController {
    @Autowired
    private MediaService mediaService;

    @Autowired
    private MediaDataController serieController;

    @QueryMapping(name = "tvserie")
    @PreAuthorize("permitAll()")
    public List<MediaModel> getSerie(@Argument Integer id, @Argument String name) {

        System.out.println("aa");

        name = name == null ? null : name.trim();

        if (name == null & id == null || name == "" & id == null) {
            return new ArrayList<>();
        }

        var medias = this.mediaService.findSerieByIdOrName(id, name);
        var newMedias = new ArrayList<MediaModel>();

        for (MediaModel media: medias) {
            
            LocalDate mediaUpdateAt = media.getUpdateAt() == null ? null : LocalDate.ofInstant(media.getUpdateAt().toInstant(), ZoneId.systemDefault());

            if (mediaUpdateAt == null) {
                media = serieController.updateAllInformation(media, null);
            } else if (ChronoUnit.DAYS.between(mediaUpdateAt, LocalDate.now()) < 14 && ChronoUnit.DAYS.between(mediaUpdateAt, LocalDate.now()) > 1) {
                // TODO a method to get only the fields updated
                // ! by now we'll use updateAllInformation
                media = serieController.updateAllInformation(media, null);
            } else if (ChronoUnit.DAYS.between(mediaUpdateAt, LocalDate.now()) > 14) {
                media = serieController.updateAllInformation(media, null);
            }
            newMedias.add(media);
        }
        return newMedias;
    }
}

I already tried change @PreAuthorize("permitAll()") to @PermitAll() and @PostAuthorize("permitAll()"), but the result are the same.

This is a very important project to me and I’ll be very grateful if you can help me, but if you can’t thanks for the attention.