Spring Security: How to allow access to unauthorized clients?

Question

Java

On REST, only a few methods require the user to be authorized. The remaining methods should be available to everyone .
For authorization, I wrote a custom filter inherited from AbstractAuthenticationProcessingFilter. The filter processes all requests coming to REST. If there is no token in the request, then attemptAuthenticationreturns

SecurityContextHolder.getContext().getAuthentication();

To be precise, AnonymousAuthenticationToken
how should HttpSecurity be configured so that all users have access to all REST methods? Other than methods marked with @Secured
The implementation of attemptAuthentication in my filter is:

@Override
    public Authentication attemptAuthentication(HttpServletRequest request,
                                                HttpServletResponse response)
            throws AuthenticationException, IOException, ServletException {
        String token = request.getHeader(HEADER_TOKEN);
        if (token == null) {
            return SecurityContextHolder.getContext().getAuthentication();
        }

        TokenAuthentication authentication = new TokenAuthentication(token);
        return getAuthenticationManager().authenticate(authentication);
    }

Current setup that doesn't work:

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                    .anyRequest()
                    .permitAll()
            .and()
                .httpBasic()
                .authenticationEntryPoint(entryPoint);
    }

Answer 1

I solved the problem by setting the filter flag continueChainBeforeSuccessfulAuthentication = true

Answer 2

Write a matcher for everything and allow it to everyone. Close the necessary endpoints, for example:

@Override
    protected void configure(final HttpSecurity http) throws Exception {
        http
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
            .csrf().disable()
            .exceptionHandling().and()
            .anonymous().and()
            .servletApi().and()
            .authorizeRequests()
            .antMatchers(HttpMethod.GET, "/api/**").permitAll()
            .antMatchers(HttpMethod.POST, "/api/**").permitAll()
            .anyRequest().authenticated().and()
            .addFilterBefore(
                    new AuthFilter(),
                    UsernamePasswordAuthenticationFilter.class
            );
    }