java - Spring Security configuration on URL and users -

i want 2 kinds of requests in rest server: has path "/freerest/" can request, others need authentication.

this code:

@configuration @componentscan @enableautoconfiguration public class application {      public static void main(string[] args) {         springapplication.run(application.class, args);     }  }  @configuration class websecurityconfiguration extends globalauthenticationconfigureradapter {    @autowired   useraccountrepository useraccountrepository;    @override   public void init(authenticationmanagerbuilder auth) throws exception {     auth.userdetailsservice(userdetailsservice());   }    @bean   userdetailsservice userdetailsservice() {     return new userdetailsservice() {        @override       public userdetails loaduserbyusername(string email) throws usernamenotfoundexception {         useraccount account = useraccountrepository.findbyemail(email);         if(account != null) {             return new user(account.getemail(), account.getpassword(), true, true, true, true,                 authorityutils.createauthoritylist("user"));         } else {             throw new usernamenotfoundexception("could not find user '"                   + email + "'");         }       }      };   } }  @enablewebsecurity @configuration class websecurityconfig extends websecurityconfigureradapter {    @override   protected void configure(httpsecurity http) throws exception {         http.authorizerequests().antmatchers("/freerest/**").permitall().and().authorizerequests().anyrequest().hasanyauthority("user");   } } 

in mind after hasanyauthority("user"), should have .permitall(). dont.

so, freerest path works fine, if try user, on database, or default spring's user 403.

what wrong?

try this. have added and() inbetween antmatch ans request. think problem.

and add correct authenticating realm followed and() shown below. here use http basic authentication restful

    @configuration     @enablewebsecurity     @enableglobalmethodsecurity(securedenabled = true, prepostenabled = true, proxytargetclass = true)     public static class apiwebsecurityconfig extends websecurityconfigureradapter{          ......         ......         ......          @override         protected void configure(httpsecurity http) throws exception {             http.csrf().disable()                     .authorizerequests()                         .antmatchers("/freerest/**").permitall()                         .anyrequest().hasanyauthority("user")                     .and()                     .httpbasic();         }          ......         ......         ......      }