How to turn off Spring Security in Spring Boot Application
<p>I have implemented authentication in my Spring Boot Application with Spring Security. </p>

<p>The main class controlling authentication should be websecurityconfig:</p>

<pre><code>@Configuration
@EnableWebSecurity
@PropertySource(value = { "classpath:/config/application.properties" })
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {


    @Autowired
    private RestAuthenticationSuccessHandler authenticationSuccessHandler;
    @Autowired
    private RestAuthenticationEntryPoint restAuthenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
          .httpBasic()
            .and()
            .csrf().disable()
            .sessionManagement().sessionCreationPolicy(
                    SessionCreationPolicy.STATELESS)
            .and()
            .exceptionHandling()
            .authenticationEntryPoint(restAuthenticationEntryPoint)
            .and()
            .authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/login").permitAll()
                .antMatchers("/logout").permitAll()
                .antMatchers("/ristore/**").authenticated()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .successHandler(authenticationSuccessHandler)
                .failureHandler(new SimpleUrlAuthenticationFailureHandler());
    }
</code></pre>

<p>Since I am doing OAuth, I have <code>AuthServerConfig</code> and <code>ResourceServerConfig</code> as well. My main application class looks like this:</p>

<pre><code>@SpringBootApplication
@EnableSpringDataWebSupport
@EntityScan({"org.mdacc.ristore.fm.models"}) 
public class RistoreWebApplication extends SpringBootServletInitializer
{
   @Bean
    public WebMvcConfigurer corsConfigurer() {
        return new WebMvcConfigurerAdapter() {
            @Override
            public void addCorsMappings(CorsRegistry registry) {
                registry.addMapping("/**").allowedOrigins("*");
            }
        };
    }
    public static void main( String[] args )
    {
        SpringApplication.run(RistoreWebApplication.class, args);
    }

    protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
         return application.sources(RistoreWebApplication.class);
     }
}
</code></pre>

<p>Since we are doing code consolidation, we need to turn off authentication temporarily. However, I tried the following methods and nothing seems to work. I am still getting 401 when I hit these rest api urls.</p>

<ol>
<li><p>Comment out all the annotations in classes related to security including <code>@Configuration</code>, <code>@EnableWebSecurity</code>. In <a href="https://stackoverflow.com/questions/23894010/spring-boot-security-disable-security">Spring boot Security Disable security</a>, it was suggested at the bottom adding <code>@EnableWebSecurity</code> will DISABLE auth which I don't think make any sense. Tried it anyway, did not work.</p></li>
<li><p>Modify websecurityconfig by removing all the security stuff and only do 
         <code>http
            .authorizeRequests()
            .anyRequest().permitAll();</code></p></li>
</ol>

<p><a href="https://stackoverflow.com/questions/25639188/disable-basic-authentication-while-using-spring-security-java-configuration">Disable Basic Authentication while using Spring Security Java configuration</a>.   Does not help either.</p>

<ol start="3">
<li><p>Remove security auto config</p>

<p>@EnableAutoConfiguration(exclude = {
    org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration.class,
    org.springframework.boot.actuate.autoconfigure.ManagementSecurityAutoConfiguration.class})</p></li>
</ol>

<p>like what they did in <a href="https://stackoverflow.com/questions/36280181/disabling-spring-security-in-spring-boot-app">disabling spring security in spring boot app</a>. However I think this feature only works with <code>spring-boot-actuator</code> which I don't have. So didn't try this.</p>

<p>What is the correct way disable spring security?</p>