==========================================================================
 jwt-auth-demo - CSRF vs permitAll()
 app started with: --spring.profiles.active=hs256,csrfon
==========================================================================

--------------------------------------------------------------------------
# A. The login endpoint is permitAll(). POST it anyway.
#    403 - and nothing in the authorization rules explains why.

HTTP 403
WWW-Authenticate: Bearer

--------------------------------------------------------------------------
# B. GET on the same permitAll() path family works. Only unsafe methods break.

HTTP 200
Content-Type: application/json
{
    "authenticationRequired": false,
    "status": "up"
}


--------------------------------------------------------------------------
# C. The filter chain, with CsrfFilter present. Count the positions:
#    CsrfFilter is 5th, AuthorizationFilter is last. The request never
#    reaches the filter that knows about permitAll().

HTTP 200
Content-Type: application/json
[
    {
        "matchesThisRequest": true,
        "filters": [
            "DisableEncodeUrlFilter",
            "WebAsyncManagerIntegrationFilter",
            "SecurityContextHolderFilter",
            "HeaderWriterFilter",
            "CsrfFilter",
            "JwtAuthenticationFilter",
            "RequestCacheAwareFilter",
            "SecurityContextHolderAwareRequestFilter",
            "AnonymousAuthenticationFilter",
            "SessionManagementFilter",
            "ExceptionTranslationFilter",
            "AuthorizationFilter"
        ],
        "chain": "DefaultSecurityFilterChain defined as 'apiFilterChain' in [class path resource [com/ankurm/jwtauth/config/SecurityConfig.class]] matching [any request] and having filters [DisableEncodeUrl, WebAsyncManagerIntegration, SecurityContextHolder, HeaderWriter, Csrf, JwtAuthentication, RequestCacheAware, SecurityContextHolderAwareRequest, AnonymousAuthentication, SessionManagement, ExceptionTranslation, Authorization]"
    }
]


--------------------------------------------------------------------------
# end