title: Spring security ignore url does not work with the we security ignore method
body: <p>We are facing an issue with SpringSecurity ignoring a method. We tried to skip authentication for a few urls (acutator/health) and resources. Authentication is being taken care externally and we are having one custom filter to extract the principle for authorization.</p>
  <p>We override the configured method as shown below:</p>
  <pre><code>public void configure(WebSecurity web) throws Exception {
          web.ignoring().antMatchers(&quot;/resources/**&quot;, &quot;/actuator/health&quot;);
  }
  protected void configure(HttpSecurity http) throws Exception {
           http.addFilter(cutstomFilter).authorizeRequests()
          .antMatchers(&quot;/add&quot;,&quot;/update&quot;,&quot;/upload&quot;).hasAuthority(&quot;ADMIN&quot;).anyRequest().authenticated()
          .and().logout().logoutSuccessUrl(&quot;/logoutUser&quot;).and()
          .exceptionHandling().accessDeniedPage(&quot;/accessDenied&quot;).and().csrf().disable();
      }
  </code></pre>
  <p>With the given implementation, our customFilter is being called for resources and health url. This is causing reauthenticating due to principle change.</p>
  <p>We tried adding this code but customFilter gets called for health url as well.</p>
  <pre><code>http.authorizeRequests().antMatchers(&quot;/actuator/health&quot;).permitAll() 
  </code></pre>
  <p>Note: Checked the @Rob Winch answer but did not understand why we need a custom filer if we are putting those url in the ignore list.
  <a href="https://stackoverflow.com/a/19985323/2138633">https://stackoverflow.com/a/19985323/2138633</a></p>