Reverted some changes and added anyRequest permitAll

application/src/main/java/org/thingsboard/server/config/ThingsboardSecurityConfiguration.java

@@ -200,10 +200,16 @@ public class ThingsboardSecurityConfiguration {
     }
 
     @Bean
-    @Order(1)
+    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-    public SecurityFilterChain noAuthFilterChain(HttpSecurity http) throws Exception {
+        http.headers(headers -> headers
-        configureCommonHttpSecurity(http)
+                        .cacheControl(config -> {})
-                .securityMatchers(config -> config
+                        .frameOptions(config -> {}).disable())
+                .cors(cors -> {})
+                .csrf(AbstractHttpConfigurer::disable)
+                .exceptionHandling(config -> {})
+                .sessionManagement(config -> config.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(config -> config
+                        .requestMatchers(NON_TOKEN_BASED_AUTH_ENTRY_POINTS).permitAll() // static resources, user activation and password reset end-points (webjars included)
                         .requestMatchers(
                                 DEVICE_API_ENTRY_POINT, // Device HTTP Transport API
                                 FORM_BASED_LOGIN_ENTRY_POINT, // Login end-point
@@ -211,18 +217,15 @@ public class ThingsboardSecurityConfiguration {
                                 TOKEN_REFRESH_ENTRY_POINT, // Token refresh end-point
                                 MAIL_OAUTH2_PROCESSING_ENTRY_POINT, // Mail oauth2 code processing url
                                 DEVICE_CONNECTIVITY_CERTIFICATE_DOWNLOAD_ENTRY_POINT, // Device connectivity certificate (public)
-                                WS_ENTRY_POINT) // WebSocket API End-points
+                                WS_ENTRY_POINT).permitAll() // Protected WebSocket API End-points
-                        .requestMatchers(NON_TOKEN_BASED_AUTH_ENTRY_POINTS)) // static resources, user activation and password reset end-points
+                        .requestMatchers(TOKEN_BASED_AUTH_ENTRY_POINT).authenticated() // Protected API End-points
-                .authorizeHttpRequests(config -> config.anyRequest().permitAll());
+                        .anyRequest().permitAll())
-        return http.build();
+                .exceptionHandling(config -> config.accessDeniedHandler(restAccessDeniedHandler))
-    }
+                .addFilterBefore(buildRestLoginProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
-
+                .addFilterBefore(buildRestPublicLoginProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
-    @Bean
+                .addFilterBefore(buildJwtTokenAuthenticationProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
-    @Order(2)
+                .addFilterBefore(buildRefreshTokenProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
-    SecurityFilterChain authFilterChain(HttpSecurity http) throws Exception {
+                .addFilterAfter(rateLimitProcessingFilter, UsernamePasswordAuthenticationFilter.class);
-        configureCommonHttpSecurity(http)
-                .securityMatcher(TOKEN_BASED_AUTH_ENTRY_POINT) // Protected API End-points
-                .authorizeHttpRequests(config -> config.anyRequest().authenticated());
         if (oauth2Configuration != null) {
             http.oauth2Login(login -> login
                     .authorizationEndpoint(config -> config
@@ -236,21 +239,6 @@ public class ThingsboardSecurityConfiguration {
         return http.build();
     }
 
-    private HttpSecurity configureCommonHttpSecurity(HttpSecurity http) throws Exception {
-        return http.headers(headers -> headers
-                        .cacheControl(config -> {})
-                        .frameOptions(config -> {}).disable())
-                .cors(cors -> {})
-                .csrf(AbstractHttpConfigurer::disable)
-                .sessionManagement(config -> config.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
-                .exceptionHandling(config -> config.accessDeniedHandler(restAccessDeniedHandler))
-                .addFilterBefore(buildRestLoginProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
-                .addFilterBefore(buildRestPublicLoginProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
-                .addFilterBefore(buildJwtTokenAuthenticationProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
-                .addFilterBefore(buildRefreshTokenProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
-                .addFilterAfter(rateLimitProcessingFilter, UsernamePasswordAuthenticationFilter.class);
-    }
-
     @Bean
     @ConditionalOnMissingBean(CorsFilter.class)
     public CorsFilter corsFilter(@Autowired MvcCorsProperties mvcCorsProperties) {