title: Spring boot security, applying an authentication filter only to certain routes
body: <p>I'm building a web application which will contain an API and an admin interface in a single application. As a result, I need two types of authentication, token based auth for the API, and form based auth for the admin interface.</p>
  
  <p>I've almost got it working by applying a filter to authenticate API tokens, however the filter is being executed for every request, and I only want it to be executes on paths matching '/api/**'.</p>
  
  <p>Hopefully it's clear from my security configuration what I'm trying to do, but sadly it doesn't work as expected.</p>
  
  <p>All API requests will start '/api/', while all admin interface requests will start '/admin/'. So I was hoping to apply different security rules to each.</p>
  
  <pre><code>@Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests().antMatchers("/api/account/login").permitAll();
          http.addFilterBefore(webServiceAuthenticationFilter, UsernamePasswordAuthenticationFilter.class).authorizeRequests().antMatchers("/api/**").hasAuthority("APIUSER");
  
          http.authorizeRequests().antMatchers("/admin/**").authenticated().and()
              .formLogin()
                  .loginPage("/admin/account/login").permitAll()
                  .passwordParameter("password")
                  .usernameParameter("username")
                  .failureUrl("/admin/account/login?error").permitAll()
                  .defaultSuccessUrl("/admin/dashboard")
                  .and()
              .logout()
                  .logoutRequestMatcher(new AntPathRequestMatcher("/admin/account/logout"))
                  .logoutSuccessUrl("/admin/account/login");
  
          http.exceptionHandling().accessDeniedPage("/admin/account/forbidden");
      }
  </code></pre>