I have setup a spring boot project using spring boot version 3.3.5 and added springdoc version 2.6.0, this project also includes spring security and my Security config is as follow:
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf(AbstractHttpConfigurer::disable)
.sessionManagement(
session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.authorizeHttpRequests(
auth ->
auth.requestMatchers("/actuator/**")
.permitAll()
.requestMatchers("/v3/api-docs/**", "/swagger-ui/**", "/swagger-ui.html")
.permitAll()
.requestMatchers("/login")
.permitAll()
.requestMatchers("/reset-password")
.permitAll()
.requestMatchers("/validate-account")
.permitAll()
.requestMatchers("/forgot-password")
.permitAll()
.requestMatchers("/validate-token")
.permitAll()
.anyRequest()
.authenticated());
http.authenticationProvider(authenticationProvider());
http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
return http.build();
}
The security config class is annotated with both @Configuration, @EnableWebSecurity and @EnableMethodSecurity(securedEnabled = true, jsr250Enabled = true)
Based on their official doc, including just the springdoc dependency it should expose the open api swagger definition under the path: /v3/api-docs which can be accessed as shown from the image but returns an empty response:
For the record, I'm using the following dependency 'cause I don't need the UI:
<dependency>
<groupId>org.springdoc</groupId>
<artifactId>springdoc-openapi-starter-webmvc-api</artifactId>
<version>${springdoc.version}</version>
</dependency>
