title: Understanding the difference of permitAll() and anonymous() in Spring Security
body: <p>I just want to make sure if I get this correctly, so I would be thankful for any response; in my configure-override:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception
  {
      http.
          [...]
          permitAll()
          [...]
  }
  </code></pre>
  
  <p>the <em>permitAll()</em> allows any request, while:</p>
  
  <pre><code>anonymous()
  </code></pre>
  
  <p>will only grant access for users that are <strong>not</strong> logged in <strong>but</strong>
  in both cases a <em>HttpSession</em>-Object is created by default.</p>
  
  <p>Is that right?</p>