401 Unauthorized Error When Accessing Swagger UI with Spring Security

Question

In my Spring Boot application (version 3.2.1), I am facing an issue where I cannot access the Swagger UI without encountering a 401 Unauthorized error. Despite configuring public access for Swagger-related paths in my SecurityConfig, the error persists.

When I navigate to http://localhost:8080/swagger-ui/, I expect to see the Swagger UI interface, which should be publicly accessible according to my Spring Security configuration. However, instead of the UI, I receive a JSON response indicating an unauthorized access error.

Here's the relevant part of the SecurityConfig where I've tried to permit public access:

companion object {
        val publicUrlArray = arrayOf(
            "/",
            "/v3/api-docs/**",
            "/swagger-ui/**",
            "/swagger-ui/index.html",
            "/favicon.ico",
            "/swagger-resources/**",
            "/webjars/**",
        )
    }

To integrate Swagger UI, I added the following dependency to my build.gradle.kts:

implementation("org.springdoc:springdoc-openapi-starter-webmvc-ui:2.4.0")

I expected that with the above configuration, the Swagger UI would be accessible without any authentication. However, the result is quite the opposite; both the Swagger UI and the favicon.ico are resulting in a 401 error as seen in the browser's console:

GET http://localhost:8080/swagger-ui/ 401 (Unauthorized) GET http://localhost:8080/favicon.ico 401 (Unauthorized) The full SecurityConfig and the CORS configuration have been set up as per standard practices, and I've confirmed they are being executed correctly. After multiple rebuilds and server restarts, the issue still occurs. I also cleared the browser cache to avoid any stale responses.

To troubleshoot further, I've checked the security settings multiple times to ensure that these paths are not secured and should allow public access. Unfortunately, this issue is still unresolved, and I'm unsure what I might be missing.

Here's a screenshot showing the unauthorized access errors in the browser console for reference: enter image description here Could someone help me understand why the Swagger UI is not accessible despite my security configurations? Any advice on what steps to take next would be greatly appreciated.