Spring Security with Spring Boot: Allowing unauthenticated user access on specific endpoints when using a filter
<p>I'm struggling with the basics of Spring Security here.</p>

<p><strong>What I wish to achieve</strong></p>

<p>My system is only for REST API handling, there's a login endpoint POST on <code>/user/sign_in</code> and a few open endpoints - GET on <code>/prompt/, /prompt/{id}, /story/, /story/{id}</code>, rest everything is for authenticated users only.</p>

<hr>

<p>I have a custom authentication filter which I've put before the <code>BasicAuthenticationFilter</code>. I'm sharing my WebSecurityConfigurerAdapter code here</p>

<pre><code>@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private DemoAuthenticationProvider demoAuthenticationProvider;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
                .antMatchers(HttpMethod.GET, "/version", "/story", "/prompt").permitAll()
                .antMatchers(HttpMethod.POST, "/user/sign_in").permitAll()
                .anyRequest().authenticated()
                .and()
                .addFilterBefore(new DemoAuthenticationFilter(), BasicAuthenticationFilter.class);
        http.csrf().disable();
    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(demoAuthenticationProvider);
    }
}
</code></pre>

<p>For the anonymous user for the open endpoints, I'm returning a null authentication token in the filter and I'm getting </p>

<blockquote>
  <p>403 Access Denied</p>
</blockquote>

<p>Why should authentication token be required when I've mentioned to permit all and not just authenticated for those end points? And how do I go about implementing it correctly?</p>