diff --git a/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt b/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt
index dd19cd3..a3cf02f 100644
--- a/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt
+++ b/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt
@@ -17,7 +17,6 @@ import org.springframework.security.config.annotation.web.configuration.EnableWe
 import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer
 import org.springframework.security.oauth2.jwt.JwtDecoder
 import org.springframework.security.oauth2.jwt.NimbusJwtDecoder
-import org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter
 import org.springframework.security.web.SecurityFilterChain
 import java.io.IOException
 
@@ -37,9 +36,8 @@ open class WebSecurityConfiguration {
                 .csrf { it.disable() }
                 .authorizeHttpRequests { it.requestMatchers(*PERMITTED_PATHS.toTypedArray<String>()).permitAll() }
                 .authorizeHttpRequests { it.requestMatchers(HttpMethod.OPTIONS).permitAll() }
-                .authorizeHttpRequests { it.anyRequest().authenticated() }
+                .authorizeHttpRequests { it.anyRequest().permitAll() }
                 .oauth2ResourceServer { obj: OAuth2ResourceServerConfigurer<HttpSecurity?> -> obj.jwt(Customizer.withDefaults()) }
-                .addFilterAfter(createPolicyEnforcerFilter(), BearerTokenAuthenticationFilter::class.java)
         return http.build()
     }