如何不在不安全的控制器之前调用 OncePerRequestFilter

Question

我正在关注 示例< /a> 有 代码<我根据 href="https://stackoverflow.com/questions/36795894/how-to-apply-spring-security-filter-only-on-secured-endpoints">spring-security-filter-only-on-secured-endpoints 。

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/secureSide/**")
           .cors().and()
           .sessionManagement()
             .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
             .and().addFilterBefore(tokenAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
              .csrf().disable()
              .formLogin().disable()
              .httpBasic().disable()
              .exceptionHandling().authenticationEntryPoint(restAuthenticationEntryPoint())
              .and().authorizeRequests()
              .anyRequest().authenticated();
    }

和两个独立的控制器 但是

@RestController
@RequestMapping("/secureSide")
@EnableAutoConfiguration(exclude = SecurityAutoConfiguration.class)
public class SecureController {
...
}



@RestController
@RequestMapping("/completelyOpen")
public class OpenController {
...
}

当客户端调用 OpenController 中定义的端点时， doFilterInternal 仍然被调用，即使应该为 SecureController 调用过滤器

那么如何调用 doFilterInternal ( ofTokenFilter extends OncePerRequestFilter ）被阻止？