title: Spring Security Java Configuration. Rules are not applied
body: <p>I am starting to use Spring Security. I've always implement my own security. So this is new for me. I've followed few tutorials. I've read even Pro Spring Security Book (unfortunatelly everythink was configured with xml).</p>
  
  <p>I would like to write Rest Api base on Spring and Spring Security. I will have to main routes to my api. First is for anonymous users, and this goes as follow: 
  <code>http://localhost:8080/cms/services/anonymous/**</code></p>
  
  <p>The second url route is for authenticated users:
  <code>http://localhost:8080/cms/services/authenticated/**</code></p>
  
  <p>When I hit url like this:
  <code>http://localhost:8080/cms/services/authenticated/testService/getInfo</code>
  I should get http answer <code>401 Unauthorized</code>. But in my current project I am getting <code>200 Ok</code>. What I am doing wrong?</p>
  
  <p>Here is my config:</p>
  
  <pre><code>import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;
  
  public class WebAppInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {
      @Override
      protected Class&lt;?&gt;[] getRootConfigClasses() {
      return new Class[] { AppConfig.class };
      }
  
      @Override
      protected Class&lt;?&gt;[] getServletConfigClasses() {
      return null;
      }
  
      @Override
      protected String[] getServletMappings() {
      return new String[] { "/" };
      }
  }
  </code></pre>
  
  <hr>
  
  <pre><code>@EnableWebMvc
  @Configuration
  @ComponentScan("pl.korbeldaniel.cms.server")
  @Import({ SecurityConfig.class })
  public class AppConfig extends WebMvcConfigurerAdapter {
  
      @Override
      public void addResourceHandlers(ResourceHandlerRegistry registry) {
      registry.addResourceHandler("/resources/**").addResourceLocations("/resources/");
      }
  
      @Override
      public void configureDefaultServletHandling(DefaultServletHandlerConfigurer configurer) {
      configurer.enable();
      }
  
      @Bean(name = "messageSource")
      public ReloadableResourceBundleMessageSource getMessageSource() {
      ReloadableResourceBundleMessageSource resource = new ReloadableResourceBundleMessageSource();
      resource.setBasename("classpath:messages");
      resource.setDefaultEncoding("UTF-8");
      return resource;
      }
  
      @Override
      public void configureMessageConverters(final List&lt;HttpMessageConverter&lt;?&gt;&gt; converters) {
      super.configureMessageConverters(converters);
      converters.add(new MappingJackson2HttpMessageConverter());
      }
  }
  </code></pre>
  
  <hr>
  
  <pre><code>@Configuration
  @ComponentScan("pl.korbeldaniel.cms.server")
  @EnableWebSecurity
  // @EnableGlobalMethodSecurity(prePostEnabled = true)
  @EnableGlobalMethodSecurity(securedEnabled = true)
  @PropertySource("classpath:jdbc.properties")
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
      @Autowired
      Environment env;
  
      @Bean
      @Override
      public AuthenticationManager authenticationManagerBean() throws Exception {
      return super.authenticationManagerBean();
      }
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.inMemoryAuthentication().withUser("temporary").password("temporary").roles("ADMIN").and().withUser("user").password("userPass").roles("USER");
      }
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
      http.httpBasic().and().authorizeRequests().//
          antMatchers("/cms/services/authenticated/**").authenticated().//
          antMatchers("/cms/services/anonymous/**").anonymous().and().//
          csrf().disable();
      }
  
      @Bean
      public DataSource getDataSource() {
      BasicDataSource dataSource = new BasicDataSource();
      dataSource.setDriverClassName(env.getProperty("jdbc.driverClassName"));
      dataSource.setUrl(env.getProperty("jdbc.url"));
      dataSource.setUsername(env.getProperty("jdbc.username"));
      dataSource.setPassword(env.getProperty("jdbc.password"));
      return dataSource;
      }
  }
  </code></pre>
  
  <hr>
  
  <pre><code>import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
  
  public class SecurityInitializer extends AbstractSecurityWebApplicationInitializer {
  }
  </code></pre>
  
  <hr>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
      version="2.5"&gt;
      &lt;!-- Name the application --&gt;
      &lt;display-name&gt;Rest GWT&lt;/display-name&gt;
      &lt;description&gt;This is web-project for cms&lt;/description&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;Spring MVC Dispatcher Servlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
              &lt;param-value&gt;/WEB-INF/classes/action-servlet.xml&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Spring MVC Dispatcher Servlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/services/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;cms.html&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <hr>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:p="http://www.springframework.org/schema/p" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:mvc="http://www.springframework.org/schema/mvc"
      xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd
  http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
  http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd"&gt;
      &lt;!-- Scans the classpath of this application for @Components to deploy as 
          beans --&gt;
      &lt;context:component-scan base-package="pl.korbeldaniel.cms" /&gt;
      &lt;!-- Configures the @Controller programming model --&gt;
      &lt;mvc:annotation-driven /&gt;
      &lt;bean
          class="org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter"&gt;
          &lt;property name="messageConverters"&gt;
              &lt;list&gt;
                  &lt;!-- &lt;bean class="org.springframework.http.converter.json.MappingJacksonHttpMessageConverter" /&gt; --&gt;
                  &lt;bean class="org.springframework.http.converter.json.MappingJackson2HttpMessageConverter"&gt;&lt;/bean&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <hr>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:context="http://www.springframework.org/schema/context"
  xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
  http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd"&gt;
  &lt;!-- registers all of Spring's standard post-processors for annotation-based configuration --&gt;
  &lt;context:annotation-config /&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>Please help.</p>