Bypass authentication for anonymous static resources

security/src/main/java/io/micronaut/security/filters/DefaultStaticResourceAuthenticationBypass.java

@@ -0,0 +1,64 @@
+/*
+ * Copyright 2017-2026 original authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.micronaut.security.filters;
+
+import io.micronaut.context.annotation.Requires;
+import io.micronaut.core.annotation.Internal;
+import io.micronaut.http.HttpMethod;
+import io.micronaut.http.HttpRequest;
+import io.micronaut.security.rules.ConfigurationInterceptUrlMapRule;
+import io.micronaut.web.router.RouteAttributes;
+import io.micronaut.web.router.resource.StaticResourceResolver;
+import jakarta.inject.Singleton;
+
+/**
+ * Default static-resource-based implementation of {@link StaticResourceAuthenticationBypass}.
+ */
+@Internal
+@Requires(classes = { HttpRequest.class, StaticResourceResolver.class })
+@Requires(beans = { ConfigurationInterceptUrlMapRule.class, StaticResourceResolver.class })
+@Requires(missingBeans = StaticResourceAuthenticationBypass.class)
+@Singleton
+final class DefaultStaticResourceAuthenticationBypass implements StaticResourceAuthenticationBypass<HttpRequest<?>> {
+
+    private final StaticResourceResolver staticResourceResolver;
+    private final ConfigurationInterceptUrlMapRule interceptUrlMapRule;
+
+    DefaultStaticResourceAuthenticationBypass(StaticResourceResolver staticResourceResolver,
+                                              ConfigurationInterceptUrlMapRule interceptUrlMapRule) {
+        this.staticResourceResolver = staticResourceResolver;
+        this.interceptUrlMapRule = interceptUrlMapRule;
+    }
+
+    /**
+     * A route always takes precedence over a static resource. For an unmatched GET or HEAD
+     * request, resolve the resource before consulting the intercept URL map.
+     *
+     * @param request The current request
+     * @return Whether authentication resolution can be skipped
+     */
+    @Override
+    public boolean shouldBypass(HttpRequest<?> request) {
+        if (!(request.getMethod() == HttpMethod.GET || request.getMethod() == HttpMethod.HEAD)) {
+            return false;
+        }
+        if (RouteAttributes.getRouteMatch(request).isPresent()) {
+            return false;
+        }
+        return staticResourceResolver.resolve(request.getUri().getPath()).isPresent()
+            && interceptUrlMapRule.isAnonymous(request);
+    }
+}

security/src/main/java/io/micronaut/security/filters/SecurityFilter.java

@@ -35,6 +35,7 @@
 import io.micronaut.security.rules.SecurityRule;
 import io.micronaut.security.rules.SecurityRuleResult;
 import io.micronaut.web.router.RouteMatch;
+import jakarta.inject.Inject;
 import org.reactivestreams.Publisher;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -62,7 +63,7 @@
     /**
      * The attribute used to store the authentication object in the request.
      */
     public static final CharSequence AUTHENTICATION = HttpAttributes.PRINCIPAL.toString();
 
     /**
      * The attribute used to store if the request was rejected and why.
@@ -85,18 +86,45 @@
     protected final Collection<AuthenticationFetcher<HttpRequest<?>>> authenticationFetchers;
 
     protected final SecurityConfiguration securityConfiguration;
+    private final StaticResourceAuthenticationBypass<HttpRequest<?>> staticResourceAuthenticationBypass;
+    private final boolean staticResourceAuthenticationBypassEnabled;
 
     /**
      * @param securityRules          The list of security rules that will allow or reject the request
      * @param authenticationFetchers List of {@link AuthenticationFetcher} beans in the context.
      * @param securityConfiguration  The security configuration
+     * @deprecated Use {@link #SecurityFilter(Collection, Collection, SecurityConfiguration, SecurityFilterConfiguration, StaticResourceAuthenticationBypass)}.
      */
+    @Deprecated(forRemoval = true, since = "5.4.0")
     public SecurityFilter(Collection<SecurityRule<HttpRequest<?>>> securityRules,
                           Collection<AuthenticationFetcher<HttpRequest<?>>> authenticationFetchers,
                           SecurityConfiguration securityConfiguration) {
         this.securityRules = securityRules;
         this.authenticationFetchers = authenticationFetchers;
         this.securityConfiguration = securityConfiguration;
+        this.staticResourceAuthenticationBypass = null;
+        this.staticResourceAuthenticationBypassEnabled = false;
+    }
+
+    /**
+     * @param securityRules The list of security rules that will allow or reject the request
+     * @param authenticationFetchers List of {@link AuthenticationFetcher} beans in the context
+     * @param securityConfiguration The security configuration
+     * @param securityFilterConfiguration The security filter configuration
+     * @param staticResourceAuthenticationBypass Determines whether authentication can be skipped for static resources
+     * @since 5.4.0
+     */
+    @Inject
+    public SecurityFilter(Collection<SecurityRule<HttpRequest<?>>> securityRules,
+                          Collection<AuthenticationFetcher<HttpRequest<?>>> authenticationFetchers,
+                          SecurityConfiguration securityConfiguration,
+                          SecurityFilterConfiguration securityFilterConfiguration,
+                          @Nullable StaticResourceAuthenticationBypass<HttpRequest<?>> staticResourceAuthenticationBypass) {
+        this.securityRules = securityRules;
+        this.authenticationFetchers = authenticationFetchers;
+        this.securityConfiguration = securityConfiguration;
+        this.staticResourceAuthenticationBypass = staticResourceAuthenticationBypass;
+        this.staticResourceAuthenticationBypassEnabled = securityFilterConfiguration.isStaticResourceAuthenticationBypass();
     }
 
     @Override
@@ -108,6 +136,12 @@
     public Publisher<MutableHttpResponse<?>> doFilter(HttpRequest<?> request, ServerFilterChain chain) {
         request.getAttributes().put(KEY, true);
 
+        if (staticResourceAuthenticationBypassEnabled
+            && staticResourceAuthenticationBypass != null
+            && staticResourceAuthenticationBypass.shouldBypass(request)) {
+            return createResponse(null, request, chain);
+        }
+
         return Flux.fromIterable(authenticationFetchers)
                 .flatMap(authenticationFetcher -> authenticationFetcher.fetchAuthentication(request))
                 .next()

security/src/main/java/io/micronaut/security/filters/SecurityFilterConfiguration.java

@@ -31,4 +31,13 @@ public interface SecurityFilterConfiguration extends Toggleable {
      */
     @NonNull
     String getPattern();
+
+    /**
+     * @return Whether authentication resolution can be bypassed for anonymous static resources
+     * @since 5.4.0
+     */
+    default boolean isStaticResourceAuthenticationBypass() {
+        return false;
+    }
+
 }

security/src/main/java/io/micronaut/security/filters/SecurityFilterConfigurationProperties.java

@@ -37,6 +37,11 @@ public class SecurityFilterConfigurationProperties implements SecurityFilterConf
     @SuppressWarnings("WeakerAccess")
     public static final boolean DEFAULT_ENABLED = true;
 
+    /**
+     * The default static resource authentication bypass enable value.
+     */
+    public static final boolean DEFAULT_STATIC_RESOURCE_AUTHENTICATION_BYPASS = false;
+
     /**
      *
      * The pattern the {@link SecurityFilter} should match.
@@ -47,6 +52,8 @@ public class SecurityFilterConfigurationProperties implements SecurityFilterConf
 
     private boolean enabled = DEFAULT_ENABLED;
 
+    private boolean staticResourceAuthenticationBypass = DEFAULT_STATIC_RESOURCE_AUTHENTICATION_BYPASS;
+
     /**
      * @return true if you want to enable the {@link SecurityFilter}
      */
@@ -55,6 +62,11 @@ public boolean isEnabled() {
         return this.enabled;
     }
 
+    @Override
+    public boolean isStaticResourceAuthenticationBypass() {
+        return staticResourceAuthenticationBypass;
+    }
+
     @Override
     @NonNull
     public String getPattern() {
@@ -69,6 +81,17 @@ public void setEnabled(boolean enabled) {
         this.enabled = enabled;
     }
 
+    /**
+     * Enables bypassing authentication resolution for anonymous static resources.
+     * Default value {@value #DEFAULT_STATIC_RESOURCE_AUTHENTICATION_BYPASS}.
+     *
+     * @param staticResourceAuthenticationBypass Whether the bypass is enabled
+     * @since 5.4.0
+     */
+    public void setStaticResourceAuthenticationBypass(boolean staticResourceAuthenticationBypass) {
+        this.staticResourceAuthenticationBypass = staticResourceAuthenticationBypass;
+    }
+
     /**
      * Pattern the {@link SecurityFilter} should match. Default value `/**`. URLS NOT MATCHED BY PREVIOUS PATTERN ARE NOT SECURED
      * @param pattern The pattern

security/src/main/java/io/micronaut/security/filters/StaticResourceAuthenticationBypass.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2017-2026 original authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.micronaut.security.filters;
+
+/**
+ * Decides whether authentication resolution can be skipped for a request.
+ *
+ * @since 5.4.0
+ * @param <T> The Request
+ */
+public interface StaticResourceAuthenticationBypass<T> {
+
+    /**
+     * Whether authentication resolution can be skipped for the request.
+     *
+     * @param request The current request
+     * @return Whether authentication resolution can be skipped
+     * @since 5.4.0
+     */
+    boolean shouldBypass(T request);
+}

security/src/main/java/io/micronaut/security/rules/ConfigurationInterceptUrlMapRule.java

@@ -16,13 +16,14 @@
 package io.micronaut.security.rules;
 
 import io.micronaut.context.annotation.Requires;
+import io.micronaut.core.annotation.Internal;
+import io.micronaut.http.HttpRequest;
 import io.micronaut.security.config.InterceptUrlMapPattern;
 import io.micronaut.security.config.InterceptUrlPatternModifier;
 import io.micronaut.security.config.SecurityConfiguration;
 import io.micronaut.security.token.RolesFinder;
 import jakarta.inject.Singleton;
 import java.util.List;
-import io.micronaut.http.HttpRequest;
 
 /**
  * A security rule implementation backed by the {@link SecurityConfiguration#getInterceptUrlMap()}.
@@ -66,4 +67,18 @@ protected List<InterceptUrlMapPattern> getPatternList() {
     public int getOrder() {
         return ORDER;
     }
+
+    /**
+     * Whether the first configured pattern that applies to the request allows anonymous access.
+     *
+     * @param request The current request
+     * @return Whether authentication resolution can be skipped for the request
+     * @since 5.4.0
+     */
+    @Internal
+    public boolean isAnonymous(HttpRequest<?> request) {
+        return findPattern(request)
+            .map(pattern -> pattern.getAccess().contains(SecurityRule.IS_ANONYMOUS))
+            .orElse(false);
+    }
 }

security/src/main/java/io/micronaut/security/rules/InterceptUrlMapRule.java

@@ -74,6 +74,19 @@ protected InterceptUrlMapRule(RolesFinder rolesFinder) {
      */
     @Override
     public Publisher<SecurityRuleResult> check(HttpRequest<?> request, @Nullable Authentication authentication) {
+        return Mono.from(findPattern(request)
+                .map(pattern -> compareRoles(pattern.getAccess(), getRoles(authentication)))
+                .orElse(Mono.just(SecurityRuleResult.UNKNOWN)));
+    }
+
+    /**
+     * Finds the first configured pattern that applies to the request, using the same
+     * method-specific precedence as {@link #check(HttpRequest, Authentication)}.
+     *
+     * @param request The current request
+     * @return The matching pattern, if any
+     */
+    protected Optional<InterceptUrlMapPattern> findPattern(HttpRequest<?> request) {
         final String path = StringUtils.trimTrailingSlashExceptRoot(request.getUri().getPath());
         final HttpMethod httpMethod = request.getMethod();
 
@@ -104,8 +117,6 @@ public Publisher<SecurityRuleResult> check(HttpRequest<?> request, @Nullable Aut
             }
         }
 
-        return Mono.from(matchedPattern
-                .map(pattern -> compareRoles(pattern.getAccess(), getRoles(authentication)))
-                .orElse(Mono.just(SecurityRuleResult.UNKNOWN)));
+        return matchedPattern;
     }
 }