title: Spring Security. Any request needs to be authorized and a special POST request needs an admin role. How to do this?
body: <p>I want to secure my HATEOAS REST API build with Spring. All requests should need authorization and POST requests to "/rooms" should need the admin role. My WebSecurityConfigurerAdapter implementation code looks like this right now:</p>
  
  <pre><code>@Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .authorizeRequests()
                  // Todo: Make sure that all resources need to be authenticated and POST rooms needs ADMIN role
                      .anyRequest().authenticated()
                      .antMatchers(HttpMethod.POST, "/api/v1/rooms").hasRole("ADMIN")
                  .and()
                  .httpBasic()
                  .and()
                  .csrf().disable();
      }
  </code></pre>
  
  <p>Right now all resources only need authentication if I put the "anyRequest().authenticated()" line before the "antMatchers..." line, but then the needed "ADMIN" role doesn't work or get applied and vice versa.</p>
  
  <p>How am I to get both things working at the same time?</p>
  
  <p>Kind Regards,
  Florian</p>