title: Spring Security: antMatchers not matching URL pattern
body: <p>Out of the blue, the security of my application is broken. It doesn't match the patterns in <code>antMatchers.(&lt;patterns&gt;).permitAll()</code>, and is trying to authenticate all the URLs. Code below</p>
  
  <pre><code>public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(preauthAuthProvider());
  }
  
  @Bean
  public PreAuthenticatedAuthenticationProvider preauthAuthProvider() {
      PreAuthenticatedAuthenticationProvider preauthAuthProvider = new PreAuthenticatedAuthenticationProvider();
      preauthAuthProvider.setPreAuthenticatedUserDetailsService(userDetailsServiceWrapper());
      return preauthAuthProvider;
  }
  
  @Bean
  public HeaderPreAuthProcessingFilter ssoFilter() throws Exception {
      HeaderPreAuthProcessingFilter filter = new HeaderPreAuthProcessingFilter();
      filter.setPrincipalRequestHeader("user_id");
      CustomUserDetailsService userDetSer = new CustomUserDetailsService();
      userDetSer.setUserService(userService);
      filter.setExceptionIfHeaderMissing(false);
      filter.setCustomUserDetailsService(userDetSer);
      filter.setAuthenticationManager(authenticationManager());
  
      return filter;
  }
  
  @Bean
  public UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt; userDetailsServiceWrapper() {
  
      CustomUserDetailsService userDetSer = new CustomUserDetailsService();
      userDetSer.setUserService(userService);
  
      UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt; wrapper = new UserDetailsByNameServiceWrapper&lt;&gt;();
      wrapper.setUserDetailsService(userDetSer);
      return wrapper;
  }
  
  protected void configure(HttpSecurity httpSecurity) throws Exception {
  
      httpSecurity
              .addFilterBefore(ssoFilter(), RequestHeaderAuthenticationFilter.class)
              .authenticationProvider(preauthAuthProvider());
  
      httpSecurity
              .exceptionHandling()
              .authenticationEntryPoint(httpAuthenticationEntryPoint)
              .and()
                  .authorizeRequests()
                      .antMatchers("/resources/**", "/", "/applogin", "/login", "/logout", "/verify**", "/verify/**", "/pub/**")
                          .permitAll()
                      .anyRequest()
                          .authenticated()
              .and()
                  .formLogin()
                      .loginPage("/signin")
                      .loginProcessingUrl("/signin")
                      .failureUrl("/signin?error")
                      .permitAll()
                      .successHandler(authSuccessHandler)
                      .failureHandler(authFailureHandler)
              .and()
                  .logout()
                  .logoutUrl("/signout").invalidateHttpSession(true).permitAll()
                  .logoutSuccessHandler(logoutSuccessHandler)
              .and()
                  .csrf().disable();
  }
  </code></pre>
  
  <p>I'm trying to access <code>{{url}}/applogin</code>. Below is the log</p>
  
  <pre><code>DEBUG 17458 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : /applogin at position 1 of 12 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
  DEBUG 17458 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : /applogin at position 2 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  DEBUG 17458 --- [nio-8080-exec-1] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
  DEBUG 17458 --- [nio-8080-exec-1] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
  DEBUG 17458 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : /applogin at position 3 of 12 in additional filter chain; firing Filter: 'HeaderWriterFilter'
  DEBUG 17458 --- [nio-8080-exec-1] o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@49168180
  DEBUG 17458 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : /applogin at position 4 of 12 in additional filter chain; firing Filter: 'LogoutFilter'
  DEBUG 17458 --- [nio-8080-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/signout', GET]
  DEBUG 17458 --- [nio-8080-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'POST /applogin' doesn't match 'GET /signout
  DEBUG 17458 --- [nio-8080-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/signout', POST]
  DEBUG 17458 --- [nio-8080-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/applogin'; against '/signout'
  DEBUG 17458 --- [nio-8080-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/signout', PUT]
  DEBUG 17458 --- [nio-8080-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'POST /applogin' doesn't match 'PUT /signout
  DEBUG 17458 --- [nio-8080-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/signout', DELETE]
  DEBUG 17458 --- [nio-8080-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'POST /applogin' doesn't match 'DELETE /signout
  DEBUG 17458 --- [nio-8080-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : No matches found
  DEBUG 17458 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : /applogin at position 5 of 12 in additional filter chain; firing Filter: 'HeaderPreAuthProcessingFilter'
   INFO 17458 --- [nio-8080-exec-1] t.l.c.w.HeaderPreAuthProcessingFilter    : Authenticating [POST /applogin]
  ...
  &lt; application logs &gt;
  ...
  DEBUG 17458 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Null ModelAndView returned to DispatcherServlet with name 'dispatcherServlet': assuming HandlerAdapter completed request handling
  DEBUG 17458 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Successfully completed request
  </code></pre>
  
  <p>I'm using Spring security version 4.2.1</p>