title: Spring Security allow all requests
body: <p>I need to develop rest application where only base auth.
  I use java-base configuration and have security class</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication().withUser("admin").password("123456").roles("ADMIN");
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests().anyRequest().denyAll();
      }
  }
  </code></pre>
  
  <p>also I see that security filter was added </p>
  
  <pre><code>[org.springframework.security.web.DefaultSecurityFilterChain] (ServerService Thread Pool -- 59) Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@5601cb02, org.springframework.security.web.context.SecurityContextPersistenceFilter@3be5386f, org.springframework.security.web.header.HeaderWriterFilter@218c240d, org.springframework.security.web.csrf.CsrfFilter@46b36d4, org.springframework.security.web.authentication.logout.LogoutFilter@d0f92f5, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@23004472, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@57a57f43, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@42b44dda, org.springframework.security.web.session.SessionManagementFilter@3a81a7cd, org.springframework.security.web.access.ExceptionTranslationFilter@53e708c7, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@66a7dab9]
  </code></pre>
  
  <p>but when I connect to my controller from browser where I have code </p>
  
  <pre><code>Authentication auth = SecurityContextHolder.getContext().getAuthentication();
  String name = auth.getName(); //get logged in username
  </code></pre>
  
  <p>I have the NPE, because auth is null. But as I understand Spring Security must decline any requests to any my urls before method executions.
  Can someone tell me where is my mistake?</p>