title: Explanation regarding Spring security URL based security
body: <p>I have two REST endpoints:</p>
  
  <ol>
  <li><code>/noAuth/rest/sayHi</code></li>
  <li><code>/rest/auth/getMsg</code></li>
  </ol>
  
  <p>I want to give login for only <code>/rest/auth/getMsg</code> and direct access to <code>/noAuth/rest/sayHi</code>.</p>
  
  <p>When I am using below pattern in <code>WebSecurityConfigurerAdapter.configure(HttpSecurity http)</code></p>
  
  <pre class="lang-java prettyprint-override"><code>@EnableWebSecurity
  @Configuration
  public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth
              .inMemoryAuthentication()
                  .withUser("Java Techie")
                  .password("Password")
                  .roles("ADMIN");
          auth
              .inMemoryAuthentication()
                  .withUser("Basant")
                  .password("Password2")
                  .roles("USER");
      }
  
      @Override 
      protected void configure(HttpSecurity http) throws Exception {
         http
             .authorizeRequests()
                 .antMatchers("/rest/**").authenticated()
                 .anyRequest().permitAll()
                 .and()
             .httpBasic();}
      }
  }
  </code></pre>
  
  <p>I only get login prompt in <code>/rest/auth/getMsg</code> but not in <code>/noAuth/rest/sayHi</code>, which is as expected.</p>
  
  <p>But when I use below pattern, I get login prompt in both <code>/rest/auth/getMsg</code> and <code>/noAuth/rest/sayHi</code> which is quite unexpected for me.</p>
  
  <pre><code>http
      .authorizeRequests()
          .anyRequest().authenticated()
          .antMatchers("/rest/**").permitAll()
          .and()
      .httpBasic();`
  </code></pre>
  
  <p>I know for IInd time I am doing something wrong, so I want to understand why I am not getting login for only <code>/rest/auth/getMsg</code> and direct access to <code>/noAuth/rest/sayHi</code>. </p>
  
  <p><strong>Update</strong> </p>
  
  <p>@nully It makes some sense but breaks my understanding for other case. Lets say if I use this pattern:</p>
  
  <pre class="lang-java prettyprint-override"><code>http
      .authorizeRequests()
          .anyRequest().authenticated()
          .anyRequest().hasRole("ADMIN")
          .and()
      .httpBasic();`
  </code></pre>
  
  <p>allows only user = "Java Techie " to login since it is an <code>ADMIN</code> and throws <code>403 Forbidden</code> for user = "Basant". </p>
  
  <p>But when I use </p>
  
  <pre><code>http
      .authorizeRequests()
          .anyRequest().authenticated()
          .antMatchers("/rest/**").hasRole("ADMIN")
          .and()
      .httpBasic();
  </code></pre>
  
  <p>from your explanation it should not allow user = "Basant" to access <code>/rest/auth/getMsg</code> since it has <code>role = "USER"</code>. But actually it is allowing me to access <code>/rest/auth/getMsg</code> when I use user = "Basant".</p>