I am creating a springboot gateway integrated with spring security, eureka and oauth2 Client
The gateway is acting as an oauth2 client for the GET Requests hence all the GET Requests needs to be authenicated
But all the posts requests need not be authenticated as they have bearer token attach with them they can pass through the gateway and can be authenticated at the microservice itself
Problem is When I am permiting all the POST requests it also disables the GET request authentication

Below, is what I am trying

@Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return webSecurity -> webSecurity.ignoring().requestMatchers(HttpMethod.POST,"/product");
    } 

or Even If I Use

        http.securityMatcher(new PathPatternParserServerWebExchangeMatcher("/product", HttpMethod.POST))
                .authorizeExchange((exchanges) -> exchanges
                        .anyExchange().permitAll()
                );

Both of them disables the autherisation of GET Requests also

If I use authorizeExchange function then it does not pass the bearer token attach with the post Requests

 http.authorizeExchange().pathMatchers("/product").permitAll()
                .anyExchange().authenticated();

I am Very new to this please ask if any other information is required thanks,

Here is complete security config for refrence

package com.example.gw2;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.security.web.server.util.matcher.PathPatternParserServerWebExchangeMatcher;

import static org.springframework.security.config.Customizer.withDefaults;

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

//    @Bean
//    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
//        http
//                .csrf().disable().cors().disable();
//
////        http
////                // ...
////                .authorizeExchange((authorize) -> authorize
////                        .pathMatchers("/products").permitAll()
////
////                        .anyExchange().denyAll()
////                );
//       // return http.build();
////        .authorizeHttpRequests((authz) -> authz
////                .requestMatchers("/api/auth/**").permitAll()
////                .anyRequest().authenticated()
////        )
//        return http.build();
//    }

    @Bean
    public SecurityWebFilterChain csrfFilterChain(ServerHttpSecurity http) throws Exception {
        http.csrf().disable();
//        http.securityMatcher(new PathPatternParserServerWebExchangeMatcher("/product", HttpMethod.POST))
//                .authorizeExchange((exchanges) -> exchanges
//                        .anyExchange().permitAll()
//                );

//        http.authorizeExchange().pathMatchers("/product").permitAll()
//                .anyExchange().authenticated();
        //http.authorizeExchange((exchange) -> exchange.anyExchange().permitAll());
        http.oauth2Login(withDefaults());
        http.oauth2Client(withDefaults());
        return http.build();
    }
    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return webSecurity -> webSecurity.ignoring().requestMatchers(HttpMethod.POST,"/product");
    }

}

Below Is the .yml for the gateway for further refrence

#Diasable csrf /questions/44400985/disable-csrf-in-spring-boot-application-with-oauth2-sso



server:
  port: 500


spring:
  application.name: backend-gateway-client
  cloud:
    gateway:
      routes:
        - id: productServiceEndPoint
          uri: http://localhost:11000
          predicates:
            - Path=/products
            - Method=GET,POST
          filters:
            - TokenRelay=
        - id: userServiceEndPoint
          uri: lb://userservice
          predicates:
            - Path=/signup
            - Method=POST
          filters:
            - SetPath=/auth/signup
    loadbalancer:
      enabled: true

  security:
    oauth2:
      client:
        registration:
          gateway:
            provider: my-provider
            client-id: GW2
            client-secret: GW2Secret
            authorization-grant-type: authorization_code
            redirect-uri: "http://localhost:500/login/oauth2/code/{registrationId}"
            scope: openid
        provider:
          my-provider:
            issuer-uri: http://localhost:2000


eureka:
  client:
    service-url:
      defaultZone: "http://localhost:9000/eureka"
    fetch-registry: true
    register-with-eureka: true

• I have Tried various ways as I stated above and queried the internet but unable to solve the issue