title: Spring Security with Spring Boot: Mix Basic Authentication with JWT token authentication
body: <p>I am trying to get Spring Security's basic authentication to work side by side with JWT token authentication with no success. I have implemented basic authentication for my web console and JWT to secure a number of API endpoints. Here's my config:</p>
  
  <pre><code>@EnableGlobalMethodSecurity(prePostEnabled = true)
  public class MultiHttpSecurityConfig {
  
  @Autowired
  private UserDetailsService userDetailsService;    
  
  @Autowired
  public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
      authenticationManagerBuilder
              .userDetailsService(this.userDetailsService)
              .passwordEncoder(bCryptPasswordEncoder());
  }
  
  @Bean
  public PasswordEncoder bCryptPasswordEncoder() {
      return new BCryptPasswordEncoder();
  }
  
  /**
   * 
   * API Security configuration
   *
   */
  @Configuration
  @Order(1) 
  public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter{
  
      @Bean
      public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
          return new JwtAuthenticationTokenFilter();
      }
  
      @Autowired
      private JwtAuthenticationEntryPoint unauthorizedHandler;
  
      @Override
      protected void configure(HttpSecurity httpSecurity) throws Exception {
      httpSecurity   
              .csrf().disable()
              .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()                
              // don't create session
              .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
              .authorizeRequests().antMatchers("/api/**","/refresh/**").authenticated()
              .antMatchers("/auth/**").permitAll().anyRequest().authenticated();               
          // Custom JWT based security filter
          httpSecurity.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
          // disable page caching
          httpSecurity.headers().cacheControl();
      }
  }
  
  /**
   * 
   * Form login security configuration
   *
   */
  @Configuration
  public static class FormLoginWebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private ConsoleAuthenticationEntryPoint consoleAuthenticationEntryPoint;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {          
          http.httpBasic().and().exceptionHandling().authenticationEntryPoint(
                  consoleAuthenticationEntryPoint).and()
           .authorizeRequests().antMatchers("/console/**").authenticated()
           .antMatchers(HttpMethod.GET,
                      "/*.html",
                      "/favicon.ico",
                      "/**/*.html",
                      "/**/*.css",
                      "/**/*.js").permitAll()
           .anyRequest().authenticated()
           .and()
           .formLogin().defaultSuccessUrl("/console/home")
           .loginPage("/console/login")
           .permitAll()
           .and()
           .logout()
           .permitAll();
          http.csrf().disable();
      }
  }
  </code></pre>
  
  <p>}</p>
  
  <p>I have noticed that the configuration I annotate with Order(1) is the one that is picked by Spring Security and the other is completely ignored. Like in the above config, I get 401 error if I try to access /console/login.
  Any help would be much appreciated.</p>