Spring security: без фильтров по умолчанию, как и что из этого получится

dependencies {   // необходимые     implementation 'org.springframework.boot:spring-boot-starter-security'     implementation 'org.springframework.boot:spring-boot-starter-web'          // для красоты, удобства и тестов     compileOnly 'org.projectlombok:lombok'     developmentOnly 'org.springframework.boot:spring-boot-devtools'     annotationProcessor 'org.springframework.boot:spring-boot-configuration-processor'     annotationProcessor 'org.projectlombok:lombok'     testImplementation 'org.springframework.boot:spring-boot-starter-test'     testImplementation 'org.springframework.security:spring-security-test' }

@Retention(RetentionPolicy.RUNTIME)  @Target({ElementType.TYPE})  @Documented  @Import({org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.class,org.springframework.security.config.annotation.web.configuration.SpringWebMvcImportSelector.class,org.springframework.security.config.annotation.web.configuration.OAuth2ImportSelector.class,org.springframework.security.config.annotation.web.configuration.HttpSecurityConfiguration.class})  @EnableGlobalAuthentication  @Configuration  public @interface EnableWebSecurity extends annotation.Annotation

org.springframework.security.web.authentication.       AnonymousAuthenticationFilter org.springframework.security.web.csrf.                 CsrfFilter org.springframework.security.web.session.              DisableEncodeUrlFilter org.springframework.security.web.access.               ExceptionTranslationFilter org.springframework.security.web.header.               HeaderWriterFilter org.springframework.security.web.authentication.logout.LogoutFilter org.springframework.security.web.savedrequest.         RequestCacheAwareFilter org.springframework.security.web.servletapi.           SecurityContextHolderAwareRequestFilter org.springframework.security.web.context.              SecurityContextPersistenceFilter org.springframework.security.web.session.              SessionManagementFilter org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter

import lombok.val; import org.springframework.context.annotation.Bean; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.web.SecurityFilterChain;  @EnableWebSecurity public class SecurityFilterChainImpl {     @Bean     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {         return chain = http                 .anonymous(AbstractHttpConfigurer::disable)         // AnonymousAuthenticationFilter                 .csrf(AbstractHttpConfigurer::disable)              // CsrfFilter                 .sessionManagement(AbstractHttpConfigurer::disable) // DisableEncodeUrlFilter, SessionManagementFilter                 .exceptionHandling(AbstractHttpConfigurer::disable) // ExceptionTranslationFilter                 .headers(AbstractHttpConfigurer::disable)           // HeaderWriterFilter                 .logout(AbstractHttpConfigurer::disable)            // LogoutFilter                 .requestCache(AbstractHttpConfigurer::disable)      // RequestCacheAwareFilter                 .servletApi(AbstractHttpConfigurer::disable)        // SecurityContextHolderAwareRequestFilter                 .securityContext(AbstractHttpConfigurer::disable)   // SecurityContextPersistenceFilter                 .build();     } }

Выключить можно и устаревшим (как выражается документация Спринга: без лямбд, ведь это менее удобно) вызовом: .anonymous().disable().and()

import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RestController;  @RestController public class Controller {      @GetMapping     public String get() {         return "Hello!";     } }

import org.junit.jupiter.api.Test; import org.springframework.boot.test.context.SpringBootTest;  import java.io.IOException; import java.net.URI; import java.net.http.HttpClient; import java.net.http.HttpRequest; import java.net.http.HttpResponse;  import static org.junit.jupiter.api.Assertions.assertEquals;  @SpringBootTest public class ControllerIT {      @Test     public void test() throws IOException, InterruptedException {         final HttpRequest request = HttpRequest.newBuilder()                 .uri(URI.create("http://localhost:8080"))                 .GET()                 .build();         final HttpClient client = HttpClient.newHttpClient();          final HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());          assertEquals("Hello!", response.body());     } }