==============================================================================
docs/output/demo11-ignoring-vs-permitall.txt
WebSecurity.ignoring() produces a real chain with ZERO filters.
GET /diag/chains  (profile: ignoring)
==============================================================================

FilterChainProxy holds 2 SecurityFilterChain(s).
The FIRST chain whose matcher accepts the request wins; the rest are never consulted.

=== chain 1/2  matcher = PathPattern [/static/**]  (0 filters)
     <no filters> - this chain does NOTHING. Requests it matches are
     unauthenticated, unauthorised, and get no security headers.

=== chain 2/2  matcher = any request  (12 filters)
   1/12  DisableEncodeUrlFilter                               order=100
   2/12  WebAsyncManagerIntegrationFilter                     order=600
   3/12  SecurityContextHolderFilter                          order=700
   4/12  HeaderWriterFilter                                   order=900
   5/12  CsrfFilter                                           order=1100
   6/12  LogoutFilter                                         order=1200
   7/12  BasicAuthenticationFilter                            order=3100
   8/12  RequestCacheAwareFilter                              order=3300
   9/12  SecurityContextHolderAwareRequestFilter              order=3400
  10/12  AnonymousAuthenticationFilter                        order=3700
  11/12  ExceptionTranslationFilter                           order=4000
  12/12  AuthorizationFilter                                  order=4200

--- response headers, ignored path vs permitAll path ---
$ curl -sD- -o /dev/null localhost:8080/static/asset.txt
HTTP/1.1 200 

$ curl -sD- -o /dev/null localhost:8080/public/hello
HTTP/1.1 200 
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
