title: Creating multiple HTTP sections in Spring Security Java Config
body: <p>Using Spring Security XML configuration, you can define multiple HTTP elements to specify different access rules for different parts of your application. The example given in <a href="http://docs.spring.io/spring-security/site/docs/3.2.x/reference/html/security-filter-chain.html#filter-chains-with-ns">8.6 Advanced Namespace Configuration</a> defines separate stateful and stateless sections of the application, with the former using sessions and form login, and the latter using no sessions and BASIC authentication:</p>
  
  <pre><code>&lt;!-- Stateless RESTful service using Basic authentication --&gt;
  &lt;http pattern="/restful/**" create-session="stateless"&gt;
      &lt;intercept-url pattern='/**' access='ROLE_REMOTE' /&gt;
      &lt;http-basic /&gt;
  &lt;/http&gt;
  
  &lt;!-- Empty filter chain for the login page --&gt;
  &lt;http pattern="/login.htm*" security="none"/&gt;
  
  &lt;!-- Additional filter chain for normal users, matching all other requests --&gt;
  &lt;http&gt;
      &lt;intercept-url pattern='/**' access='ROLE_USER' /&gt;
      &lt;form-login login-page='/login.htm' default-target-url="/home.htm"/&gt;
      &lt;logout /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>I can't figure out how to do the same thing with Java Config. It's important that I disable sessions and use a different entry point for my web services. Right now I have the following:</p>
  
  <pre><code>@Override
  public void configure(WebSecurity security)
  {
      security.ignoring().antMatchers("/resource/**", "/favicon.ico");
  }
  
  @Override
  protected void configure(HttpSecurity security) throws Exception
  {
      security
              .authorizeRequests()
                  .anyRequest().authenticated()
              .and().formLogin()
                  .loginPage("/login").failureUrl("/login?loginFailed")
                  .defaultSuccessUrl("/ticket/list")
                  .usernameParameter("username")
                  .passwordParameter("password")
                  .permitAll()
              .and().logout()
                  .logoutUrl("/logout").logoutSuccessUrl("/login?loggedOut")
                  .invalidateHttpSession(true).deleteCookies("JSESSIONID")
                  .permitAll()
              .and().sessionManagement()
                  .sessionFixation().changeSessionId()
                  .maximumSessions(1).maxSessionsPreventsLogin(true)
                  .sessionRegistry(this.sessionRegistryImpl())
              .and().and().csrf()
                  .requireCsrfProtectionMatcher((r) -&gt; {
                      String m = r.getMethod();
                      return !r.getServletPath().startsWith("/services/") &amp;&amp;
                              ("POST".equals(m) || "PUT".equals(m) ||
                                      "DELETE".equals(m) || "PATCH".equals(m));
                  });
  }
  </code></pre>
  
  <p>Using this I was able to disable CSRF protection for my web services. But I really need a whole separate HTTP configuration so that I can disable sessions and specify a different entry point. I know I can use <code>requestMatcher</code> or <code>requestMatchers</code> to restrict the URIs that it applies to, but it doesn't appear that you can use this to create separate configurations. It's almost like I need <em>two</em> <code>configure(HttpSecurity security)</code> methods.</p>