How do i whitelist api in JWT Filter

I have SpringSecurityWebAppConfig class that uses my own filter class JwtAuthenticationFilter.

The question now is how do i bypass my JwtAuthenticationFilter for api calls that does not have request header and/or token. Do I set it as a configurable and read it in the filter?

My JwtAuthenticationFilter is an imported class from another library. The purpose is to reuse the file for the other microservices.

Example:

/scanFile does not need request token. When I add into SpringSecurityWebAppConfig. My filter is throw 401 as it does not have request token.

SpringSecurityWebAppConfig class:

public class SpringSecurityWebAppConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    public JwtAuthenticationFilter jwtAuthenticationFilter;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeRequests()
            .antMatchers("/homePage").access("hasRole('ROLE_USER') or hasRole('ROLE_ADMIN')")
            .antMatchers("/userPage").access("hasRole('ROLE_USER')")
            .antMatchers("/adminPage").access("hasRole('ROLE_ADMIN')")
            .antMatchers(HttpMethod.DELETE, "/data").access("hasRole('ROLE_ADMIN')")
            .antMatchers("/login").permitAll()
            .antMatchers("/logout").authenticated()
            .and()
            .anonymous().disable()
            .exceptionHandling()
            .authenticationEntryPoint(new CustomAuthenticationEntryPoint())
            .and()
            .headers()
            .httpStrictTransportSecurity()
            .includeSubDomains(true).maxAgeInSeconds(31536000);


        // Add a filter to validate the tokens with every request
        http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
    }
}

JwtAuthenticationFilter Class:

 private void getJwtFromRequest(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

      
            String bearerToken = request.getHeader("Authorization");

            // Step 1: Check if bearer token exist in authorization header and if bearer token start with "Bearer "
            if (!StringUtils.hasText(bearerToken) || !bearerToken.startsWith("Bearer ")) {

                String errorMsg = "No access token found in request headers.";

                Error err = new Error(JWT_AUTHENTICATION_FILTER, "AccessTokenMissingException", errorMsg);

                // Java object to JSON string
                String jsonString = mapper.writeValueAsString(err);

                log.error(jsonString);

                throw new AccessTokenMissingException(errorMsg);
            }

//rest of the processing here ...
}

so you want to whitelist some apis even without spring security authentication?

you can use web.ignoring().antMatchers() in your SpringSecurityWebAppConfig, to exclude the urls from spring security.

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/scanFile/**”);
}