Failing to exclude some URLs from Spring Security protection
<p>We have the following spring security configuration:</p>

<pre><code>&lt;bean id="authenticationSuccessHandler" class="***.JsonAuthenticationSuccessHandler"/&gt;

    &lt;bean id="logoutSuccessHandler" class="***.web.security.***UrlLogoutSuccessHandler"&gt;
        &lt;property name="redirectStrategy" ref="noRedirectStrategy"/&gt;
    &lt;/bean&gt;

    &lt;bean id="authenticationFailureHandler"
          class="***.web.security.***UrlAuthenticationFailureHandler"/&gt;

    &lt;bean id="httpStatusEntryPoint" class="org.springframework.security.web.authentication.HttpStatusEntryPoint"&gt;
        &lt;constructor-arg value="UNAUTHORIZED"/&gt;
    &lt;/bean&gt;

    &lt;security:http auto-config="true" use-expressions="false" entry-point-ref="httpStatusEntryPoint"&gt;
        &lt;security:custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrentSessionFilter"/&gt;

        &lt;security:form-login
                authentication-success-handler-ref="authenticationSuccessHandler"
                authentication-failure-handler-ref="authenticationFailureHandler"
                /&gt;

        &lt;security:intercept-url pattern="/api/**"/&gt;
        &lt;security:anonymous enabled="false"/&gt;
        &lt;security:logout logout-url="/logout" delete-cookies="JSESSIONID,sessionId"
                         success-handler-ref="logoutSuccessHandler"
                /&gt;
        &lt;security:csrf disabled="true"/&gt;

        &lt;security:session-management session-authentication-strategy-ref="sessionAuthenticationStrategy"/&gt;
    &lt;/security:http&gt;

    &lt;bean id="concurrentSessionFilter" class="***.***ConcurrentSessionFilter"&gt;
        &lt;constructor-arg ref="***SessionRegistry"/&gt;
        &lt;constructor-arg ref="errorController"/&gt;
    &lt;/bean&gt;

    &lt;bean id="sessionAuthenticationStrategy" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy"&gt;
        &lt;constructor-arg&gt;
            &lt;list&gt;
                &lt;ref bean="registerSessionAuthenticationStrategy"/&gt;
                &lt;ref bean="concurrentSessionControlAuthenticationStrategy"/&gt;
            &lt;/list&gt;
        &lt;/constructor-arg&gt;
    &lt;/bean&gt;

    &lt;bean id="registerSessionAuthenticationStrategy" class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy"&gt;
        &lt;constructor-arg name="sessionRegistry" ref="***SessionRegistry" /&gt;
    &lt;/bean&gt;

    &lt;bean id="concurrentSessionControlAuthenticationStrategy" class="***.web.security.***ConcurrentSessionControlAuthenticationStrategy"&gt;
        &lt;constructor-arg name="sessionRegistry" ref="***SessionRegistry" /&gt;
        &lt;constructor-arg name="logoutService" ref="logoutService"/&gt;
        &lt;property name="maximumSessions" value="1" /&gt;
    &lt;/bean&gt;

    &lt;!-- enable spring security annotation processing --&gt;
    &lt;security:global-method-security secured-annotations="enabled"/&gt;

    &lt;bean id="***LdapAuthenticationProvider" class="***.web.***LdapAuthProvider"&gt;
        &lt;property name="url" value="${ldap.url}"/&gt;
        &lt;property name="filter" value="${ldap.filter}"/&gt;
        &lt;property name="domain" value="${ldap.domain}"/&gt;
        &lt;property name="dn" value="${ldap.dn}"/&gt;
        &lt;property name="ldapEnabled" value="${ldap.enable}"/&gt;
    &lt;/bean&gt;

    &lt;security:authentication-manager&gt;
        &lt;security:authentication-provider ref="***LdapAuthenticationProvider"/&gt;
        &lt;security:authentication-provider user-service-ref="***UserDetailsService"/&gt;
    &lt;/security:authentication-manager&gt;

    &lt;bean id="usersResource" class="org.springframework.core.io.ClassPathResource"&gt;
        &lt;constructor-arg value="/users.properties" /&gt;
    &lt;/bean&gt;

    &lt;util:property-path id="usersResourceFile" path="usersResource.file" /&gt;

    &lt;bean id="***UserDetailsService" class="***.web.security.***InMemoryUserDetailsManager"&gt;
        &lt;constructor-arg index="0" ref="usersResourceFile"/&gt;
    &lt;/bean&gt;
</code></pre>

<p>I tried different ways But I can not find a way to exclude some specific URLs from authentication.</p>

<p>For example:</p>

<pre><code>/api/url/available/without/login
</code></pre>

<p>should be available even user is not logged in.</p>

<h2>P.S.</h2>

<p>I have tried to apply this answer, but it doesn't work for me:</p>

<p><a href="https://stackoverflow.com/a/5382178/2674303">https://stackoverflow.com/a/5382178/2674303</a></p>

<h2>UPD</h2>

<p>I have tired</p>

<pre><code>    ....
    &lt;bean id="httpStatusEntryPoint" class="org.springframework.security.web.authentication.HttpStatusEntryPoint"&gt;
        &lt;constructor-arg value="UNAUTHORIZED"/&gt;
    &lt;/bean&gt;
    &lt;security:http pattern="/api/url/available/without/login" security="none"/&gt;
    &lt;security:http auto-config="true" use-expressions="false" entry-point-ref="httpStatusEntryPoint"&gt;
    ....
</code></pre>

<p>but when I try to use - this url still locked and I get 401</p>

<p>because this code:</p>

<pre><code> SecurityContext securityContext = SecurityContextHolder.getContext();
 Authentication authentication = securityContext.getAuthentication();
 if (authentication == null || !authentication.isAuthenticated()) {
       String name = authentication != null ? authentication.getName() : "";
       throw new BadCredentialsException("Could not find user " + name);
  }
</code></pre>

<p>throws exception</p>