title: TokenRelayGatewayFilterFactory protecting all URL's
body: <p>I have a project <a href="https://github.com/ndrone/sample-gateway-oauth2login/tree/feature/allowAllToHealth" rel="nofollow noreferrer">https://github.com/ndrone/sample-gateway-oauth2login/tree/feature/allowAllToHealth</a> That I am trying to allow specific URL's open to anyone that request it. In this case, it is the health endpoint of Actuator while protect all other Actuator endpoints. What I am finding is that the <code>TokenRelayGatewayFilterFactory</code> is being applied to all routes when though it is only set to be applied to one route. Not sure what I got wrong.</p>
  
  <p><strong>SecurityConfig in the Resource Service</strong></p>
  
  <pre><code>@EnableWebFluxSecurity
  public class SecurityConfig {
  
  @Bean
  SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) throws Exception {
  
      http.authorizeExchange().pathMatchers("/manage/health").permitAll();
      http
          .authorizeExchange()
              .pathMatchers("/resource", "/manage/**").hasAuthority("SCOPE_resource.read")
              .anyExchange().authenticated()
              .and()
          .oauth2ResourceServer()
              .jwt();
          return http.build();
          }
  }
  </code></pre>
  
  <p><strong>Gateway Routes</strong></p>
  
  <pre><code>@Controller
  @SpringBootApplication
  public class GatewayApplication {
  
  @Autowired
  private TokenRelayGatewayFilterFactory filterFactory;
  
  @Bean
  public RouteLocator customRouteLocator(RouteLocatorBuilder builder) {
      //@formatter:off
      return builder.routes()
              .route("resource-health", r -&gt; r.path("/resource/manage/health")
                      .filters(f -&gt; f.stripPrefix(1))
                      .uri("http://localhost:9000"))
              .route("resource-actuator-protected", r -&gt; r.path("/resource/manage/**")
                      .filters(f -&gt; f.stripPrefix(1).filter(filterFactory.apply()))
                      .uri("http://localhost:9000"))
              .route("resource", r -&gt; r.path("/resource")
                      .filters(f -&gt; f.filter(filterFactory.apply()))
                      .uri("http://localhost:9000"))
              .build();
      //@formatter:on
  }
  
  @GetMapping("/")
  public String index(Model model,
                      @RegisteredOAuth2AuthorizedClient OAuth2AuthorizedClient authorizedClient,
                      @AuthenticationPrincipal OAuth2User oauth2User) {
      model.addAttribute("userName", oauth2User.getName());
      model.addAttribute("clientName", authorizedClient.getClientRegistration().getClientName());
      model.addAttribute("userAttributes", oauth2User.getAttributes());
      return "index";
  }
  
  public static void main(String[] args) {
      SpringApplication.run(GatewayApplication.class, args);
  }
  
  }
  </code></pre>