title: Use Spring Security Filter to lock down everything except a few routes
body: <p>We're reworking our product to remove the default "anonymousUser" behavior in SpringSecurity and would like to lock down all URLs (via filter security) with the exception of just a few endpoints. What we can't figure out is how to specify "lock down everything except X, Y, and Z" </p>
  
  <p>Our security setup essentially boils down to the following:</p>
  
  <pre><code>@Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              // disable anonymous users
              .anonymous().disable()
  
              // don't add ROLE_ to the role...
              .authorizeRequests()
                  .regexMatchers("^/", "^/login", "^/mobile/login", "^/api/auth/.*")
                      .authenticated()
                  .and()  
          ;
      }
  }
  </code></pre>
  
  <p>Other routes I've taken have been akin to : </p>
  
  <pre><code>@Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              // disable anonymous users
              .anonymous().disable()
  
              // don't add ROLE_ to the role...
              .authorizeRequests()
              .antMatchers("/**")
                  .authenticated()
              .antMatchers("/", "/login", "/mobile/login", "/api/auth/**", "/reservations/**")
                  .permitAll()
              .and()
          ;
      }
  }
  </code></pre>
  
  <p>Any advice / input would be appreciated. </p>
  
  <p>Thanks! </p>