title: Spring security antMatcher does not work
body: <p><strong>EDIT:</strong></p>
  
  <p>I further drilled down the problem and turns out issue persists even with single configuration. If I use single configuration and keep </p>
  
  <pre><code>http.antMatcher("/api/test/**")
  </code></pre>
  
  <p>urls don't get secured. 
  Removing the antMatcher and antMatchers immediately secures the url. 
  i.e if I use:</p>
  
  <pre><code>http.httpBasic()
      .and()
      .authorizeRequests()
      .anyRequest()
      .authenticated();
  </code></pre>
  
  <p>then only spring security is securing url. Why isn't antMatcher functioning?</p>
  
  <p>(Updated the title to include actual issue.)</p>
  
  <hr>
  
  <p><strong>Original Post:</strong></p>
  
  <p>I have referred following stackoverflow questions:</p>
  
  <ol>
  <li><p><a href="https://stackoverflow.com/questions/33037559/spring-rest-security-secure-different-urls-differently">Spring REST security - Secure different URLs differently</a></p></li>
  <li><p><a href="https://stackoverflow.com/questions/40258583/using-multiple-websecurityconfigureradapter-with-different-authenticationprovide">Using multiple WebSecurityConfigurerAdapter with different AuthenticationProviders (basic auth for API and LDAP for web app)</a></p></li>
  </ol>
  
  <p>and spring security doc:</p>
  
  <p><a href="https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#multiple-httpsecurity" rel="noreferrer">https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#multiple-httpsecurity</a></p>
  
  <p>But I am not able to configure multiple http security elements.
  When I follow the official spring doc, it works in my case only becuase of the fact that the second http security element is a catch-all, but as soon as I add a specific url, all the urls can be accessed without any authentication.</p>
  
  <p>Here's my code:</p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  public class SecurityConfig {
  
      @Bean                                                             
      public UserDetailsService userDetailsService() throws Exception {
          InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
          manager.createUser(User.withUsername("user").password("userPass").roles("USER").build());
          manager.createUser(User.withUsername("admin").password("adminPass").roles("ADMIN").build());
          return manager;
      }
  
  
      @Configuration
      @Order(1)                                                        
      public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
  
          @Override       
          public void configure(AuthenticationManagerBuilder auth) 
            throws Exception {            
              auth.inMemoryAuthentication().withUser("user").password("user").roles("USER");
              auth.inMemoryAuthentication().withUser("admin").password("admin").roles("ADMIN");
          }
  
          protected void configure(HttpSecurity http) throws Exception {
              http
                  .antMatcher("/api/v1/**")                               
                  .authorizeRequests()
                  .antMatchers("/api/v1/**").authenticated()
                      .and()
                  .httpBasic();
          }
      }
  
      @Configuration
      @Order(2)
      public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
  
          @Override       
          public void configure(AuthenticationManagerBuilder auth) 
            throws Exception {
  
              auth.inMemoryAuthentication().withUser("user1").password("user").roles("USER");
              auth.inMemoryAuthentication().withUser("admin1").password("admin").roles("ADMIN");
          }
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http
                  .antMatcher("/api/test/**")
                  .authorizeRequests()
                  .antMatchers("/api/test/**").authenticated()
                      .and()
                  .formLogin();
          }
      }
  }
  </code></pre>
  
  <p>Now any url can be accessed. If I remove antMatcher from second configuration, all the urls become secured.</p>