Spring-Boot adding basic http security to REST service
<p>I am tasked with building a REST service which requires authentication on a couple of actions, while permitting anonymous users on others.</p>

<p>For example:</p>

<pre><code>| Path         | Requires authentication |
| /add         | YES                     |
| /{name}      | NO                      |
| /report/{id} | YES                     |
</code></pre>

<p>However I'm having issues with setting up spring-security to work this way.</p>

<p>If I override <code>WebSecurityConfigurerAdapter</code> <code>configure</code> function like this:</p>

<pre><code>@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .csrf().disable()                
            .and()
            .httpBasic()
            .and()
            .authorizeRequests()                
            //.antMatchers(HttpMethod.GET, "/{name}").permitAll() // I can't really specify a dynamic url here, can i?
            .anyRequest().authenticated();                
}
</code></pre>

<p>With this configuration, any action I invoke will first display the standard browser basic authentication pop-up form. That is what I want, except I don't want this on the dynamic url <code>/{name}</code> action. </p>

<p>So instead I tried removing <code>.anyRequest().authenticated()</code> and activating <code>@PreAuthorize</code> and <code>@PostAuthorize</code> annotations with 
<code>@EnableGlobalMethodSecurity(proxyTargetClass = true, prePostEnabled = true)</code>
and add annotations to controller actions as following:</p>

<pre><code>| Path         | Annotation                         |
| /add         | @PreAuthorize("isAuthenticated()") |
| /{name}      | @PreAuthorize("permitAll()")       |
| /report/{id} | @PreAuthorize("isAuthenticated()") |
</code></pre>

<p>With this the <code>/{name}</code> action allows anonymous users as expected, however <code>/add</code> and <code>/report/{id}</code> actions now just return "Access is denied" with status 500, instead of forcing basic auth.</p>

<p>How can I force basic authentication on select controller methods while allowing anonymous access on others?</p>