title: Use AbstractAuthenticationProcessingFilter for multiple URLs
body: <p>I have the below endpoint patterns in my application</p>
  <ol>
  <li>/token -- accessible to all</li>
  <li>/rest/securedone/** -- requires authentication</li>
  <li>/rest/securedtwo/** -- requires authentication</li>
  <li>/rest/unsecured/** -- does not require authentication</li>
  </ol>
  <p>As of now, I am able to access the /token endpoint.
  But /rest/securedone/** and /rest/unsecured/** return 401 when a token(JWT) is not sent. It is my intention to secure /rest/securedone/** and that is fine /rest/unsecured/** should be accessible.</p>
  <p>My httpSecurity config is as below:</p>
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
              .cors()
              .and()
              .csrf().disable()
              .authorizeRequests()
                  .antMatchers(&quot;/token&quot;).permitAll()
                  .antMatchers(&quot;/rest/secured/**&quot;).authenticated()
              .and()
              .exceptionHandling()
                  .authenticationEntryPoint(authenticationEntryPoint)
              .and()
                  .sessionManagement()
                      .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  
      http.addFilterBefore(authenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class);
  
      http.headers().cacheControl();
  }
  </code></pre>
  <p>and my AbstractAuthenticationProcessingFilter extended class is as below:</p>
  <pre class="lang-java prettyprint-override"><code>public class MyAuthenticationTokenFilter extends AbstractAuthenticationProcessingFilter {
  
      private static Logger log = LoggerFactory.getLogger(MyAuthenticationTokenFilter.class);
  
      public MyAuthenticationTokenFilter() { super(&quot;/rest/**&quot;);  }
  
      @Override
      public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, ServletException {
          //authentication handling code
      }
  
  
      @Override
      protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
          super.successfulAuthentication(request, response, chain, authResult);
          chain.doFilter(request, response);
      }
  }
  </code></pre>
  <p>Can someone please help my figure out the below:</p>
  <ol>
  <li><p>When is the MyAuthenticationTokenFilter used? For which URL will it be invoked? How come, <code>/rest/unsecured/**</code> is also expecting authentication? It happens even if i explicitly say <code>.antMatchers(&quot;/rest/secured/**&quot;).permitAll()</code>.</p>
  </li>
  <li><p>Can I specify multiple url patterns in my <code>super(defaultFilterProcessingUrl)</code> call inside <code>MyAuthenticationTokenFilter</code> constructor? For example, if I have another url such as <code>/api/secured/**</code>, how can I get my <code>MyAuthenticationTokenFilter</code> to be invoked for <code>/api/secured/**</code> requests? I do not need different authentication handling so I want to re-use this filter.</p>
  </li>
  </ol>