I have this security config for spring boot api and even when I permit some endpoints like login or reg