title: Mix HttpBasic and FormLogin in Spring Security with Spring-boot-starter
body: <p>I use spring-boot-starter 0.5.0.M6 with spring security to build my application which contains:</p>
  
  <ol>
  <li><strong>"/admin/</strong>"**: should be accessible to anyone have role ADMIN, form-based login</li>
  <li><strong>"/api/</strong>"**: should be accessible to anyone have role API, http basic login</li>
  </ol>
  
  <p>My first attempt was:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
        http
          .authorizeRequests()
            .antMatchers("/resources/**").permitAll()
            .antMatchers("/admin/**").hasRole("ADMIN")
          .and()
            .formLogin()
            .defaultSuccessUrl("/admin/home")
            .loginPage("/login")
            .permitAll()
          .and()
            .logout()
            .logoutRequestMatcher(new AntPathRequestMatcher("/logout", "GET"))
            .permitAll();  
        http
          .authorizeRequests()
            .antMatchers("/api/**").hasRole("API")
          .and()
            .httpBasic();
  }
  </code></pre>
  
  <p>With this approach:</p>
  
  <ol>
  <li>all the "/admin/<strong>" and "/api/</strong>" can authentication use both basic &amp; form-based login. This is not a critical issue.</li>
  <li>when any security issue occurred, eg: authentication failed, or authorization failed, the login form is shown. This is a critical issue, I want if /api/** get authentication failed or authorization failed, it show the basic authentication popup with 401/403 status code.</li>
  </ol>
  
  <p>Then I try with the solution from <code>https://github.com/spring-projects/spring-security-javaconfig/blob/master/samples-web.md#sample-multi-http-web-configuration</code>, but I only able to secure either <code>/api/**</code> or <code>/admin/**</code> but not both, depends on which one I annotated with <code>@Order</code>.</p>
  
  <p>Please give me a hand.</p>
  
  <p>Thanks much</p>