title: Multiple antMatchers in Spring security
body: <p>I work on content management system, that has five <em>antMatchers</em> like the following:</p>
  
  <pre><code>http.authorizeRequests()
          .antMatchers("/", "/*.html").permitAll()
          .antMatchers("/user/**").hasRole("USER")
          .antMatchers("/admin/**").hasRole("ADMIN")
          .antMatchers("/admin/login").permitAll()
          .antMatchers("/user/login").permitAll()
          .anyRequest().authenticated()
          .and()
          .csrf().disable();
  </code></pre>
  
  <p>which suppose to mean that the visitors can see all site at root path (/*), and users can see only (/user), admin can see only (/admin), and there are two login pages one for users and another for admin.</p>
  
  <p>The code seems to work fine, except the admin section - it doesn't work but  return access denied exception.</p>