title: Spring Security Configuration - HttpSecurity vs WebSecurity
body: <p>I just need to understand something in Spring Security Configuration. Using the example below...</p>
  
  <pre><code>@Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .httpBasic()
              .and()
              .authorizeRequests().antMatchers("/secret/**").authenticated()
              .and()
              .authorizeRequests().antMatchers("/**").permitAll();
      }
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring().antMatchers("/resources/**");
      }
  
  }
  </code></pre>
  
  <p>What is the purpose of <code>configure(WebSecurity web)</code> method? </p>
  
  <p>Can't I just add <code>/resources/**</code> in the <code>configure(HttpSecurity http)</code> method in this line <code>.authorizeRequests().antMatchers("/**", "/resources/**").permitAll();</code>
  Shouldn't it work the same i.e. permitting all requests to <code>/resources/**</code> without any authentication?</p>