Spring Security allow all requests -

i need develop rest application base auth. use java-base configuration , have security class

@configuration @enablewebsecurity public class securityconfig extends websecurityconfigureradapter {      @autowired     public void configureglobal(authenticationmanagerbuilder auth) throws exception {         auth.inmemoryauthentication().withuser("admin").password("123456").roles("admin");     }      @override     protected void configure(httpsecurity http) throws exception {         http.authorizerequests().anyrequest().denyall();     } } 

also see security filter added

[org.springframework.security.web.defaultsecurityfilterchain] (serverservice thread pool -- 59) creating filter chain: org.springframework.security.web.util.matcher.anyrequestmatcher@1, [org.springframework.security.web.context.request.async.webasyncmanagerintegrationfilter@5601cb02, org.springframework.security.web.context.securitycontextpersistencefilter@3be5386f, org.springframework.security.web.header.headerwriterfilter@218c240d, org.springframework.security.web.csrf.csrffilter@46b36d4, org.springframework.security.web.authentication.logout.logoutfilter@d0f92f5, org.springframework.security.web.savedrequest.requestcacheawarefilter@23004472, org.springframework.security.web.servletapi.securitycontextholderawarerequestfilter@57a57f43, org.springframework.security.web.authentication.anonymousauthenticationfilter@42b44dda, org.springframework.security.web.session.sessionmanagementfilter@3a81a7cd, org.springframework.security.web.access.exceptiontranslationfilter@53e708c7, org.springframework.security.web.access.intercept.filtersecurityinterceptor@66a7dab9] 

but when connect controller browser have code

authentication auth = securitycontextholder.getcontext().getauthentication(); string name = auth.getname(); //get logged in username 

i have npe, because auth null. understand spring security must decline requests urls before method executions. can tell me mistake?

try with

.authorizerequests().anyrequest().authenticated() 

if problem persists think may due anonymousauthenticationfilter puts anonymoustoken in securitycontextholder. in case need disable filter anonymous().disable() or use rolevoter.

.authorizerequests().antmatchers("/*").hasrole("admin") 

update: doubt, sure app taking configuration securityconfig?. spring documentation have this:

public class mvcwebapplicationinitializer extends abstractannotationconfigdispatcherservletinitializer {      @override     protected class<?>[] getrootconfigclasses() {         return new class[] { securityconfig.class };     }      // ... other overrides ... } 

i don't know if @configuration works in websecurityconfigureradapter