title: Spring Security OAuth2: '#oauth2.xxx' expressions not evaluted with multiple RequestMatchers mapped to the same FilterChain
body: <p>In a multi modules app I've defined 5 RequestMatchers mapped to the same FilterChain, like below:</p>
  
  <pre><code>@Configuration
  public class Module1SecurityFilterChain extends ResourceServerConfigurerAdapter {
  
     @Override
     public void configure( HttpSecurity http ) throws Exception {
        http.sessionManagement().sessionCreationPolicy( STATELESS );
        http.requestMatchers().antMatchers( "/module1/**")
              .and()
              .authorizeRequests()
              .antMatchers( "/module1/resource").authenticated()
              .antMatchers( "/module1/test" ).access( "#oauth2.isClient()")
              .anyRequest().access( "#oauth2.hasScope('webclient')" );
     }
  }
  </code></pre>
  
  <p>And module2:</p>
  
  <pre><code>@Configuration
  public class Module2SecurityFilterChain extends ResourceServerConfigurerAdapter {
  
     @Override
     public void configure( HttpSecurity http ) throws Exception {
        http.sessionManagement().sessionCreationPolicy( STATELESS );
        http.requestMatchers().antMatchers( "/module2/**")
              .and()
              .authorizeRequests()
              .antMatchers( "/module2/resource").authenticated()
              .antMatchers( "/module2/test" ).access( "#oauth2.isClient()")
              .anyRequest().access( "#oauth2.hasScope('webclient')" );
     }
  }
  </code></pre>
  
  <p>And enabled method security:</p>
  
  <pre><code>@Configuration
  @EnableGlobalMethodSecurity( prePostEnabled = true, securedEnabled = true )
  public class MethodSecurityConfiguration extends GlobalMethodSecurityConfiguration {
  
      @Override
      protected MethodSecurityExpressionHandler createExpressionHandler() {
          return new OAuth2MethodSecurityExpressionHandler();
      }
  }
  </code></pre>
  
  <p>The problem is that all <code>#oauth2.xx</code> expressions are evaluated only for the 1st module requestmatcher <code>/module1/**</code> and ignored in others. When I authenticate a user and try to access to <code>/module1/test</code> the access is denied as expected whereas when accessing to <code>/module2/test</code> access is granted (it should also be denied). </p>
  
  <p>Could someone explains me why and how to solve this? I know Spring Security isn't easy at all... 
  Thanks again.</p>
  
  <p><strong>EDIT</strong> 
  @Darren Forsythe (thanks for your comment)
  The filter chains created are:</p>
  
  <pre><code>INFO | o.s.s.w.DefaultSecurityFilterChain | Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/oauth/token'], Ant [pattern='/oauth/token_key'], Ant [pattern='/oauth/check_token']]], [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@f55a810b, org.springframework.security.web.context.SecurityContextPersistenceFilter@85021903, org.springframework.security.web.header.HeaderWriterFilter@1d0744d1, org.springframework.security.web.authentication.logout.LogoutFilter@2d15146a, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@c38f3266, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@8f9bf85, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@74a71be5, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@e4eb6cc, org.springframework.security.web.session.SessionManagementFilter@22f6b39a, org.springframework.security.web.access.ExceptionTranslationFilter@960c464f, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@f7a19dc5]
  INFO | o.s.s.w.DefaultSecurityFilterChain | Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/module1/**'], Ant [pattern='/module2/**'], Ant [pattern='/module3/**'], Ant [pattern='/module4/**'], Ant [pattern='/module5/**'], Ant [pattern='/module6/**']]], [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@38ef2427, org.springframework.security.web.context.SecurityContextPersistenceFilter@a26ff7af, org.springframework.security.web.header.HeaderWriterFilter@5344e710, org.springframework.security.web.authentication.logout.LogoutFilter@da0534c8, org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter@2956c7ab, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@5682f610, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@f4cbf7a4, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@d1b1395a, org.springframework.security.web.session.SessionManagementFilter@d352f8ab, org.springframework.security.web.access.ExceptionTranslationFilter@9bb1d86, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@73c7a695]
  INFO | o.s.s.w.DefaultSecurityFilterChain | Creating filter chain: any request, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@1cc2056f, org.springframework.security.web.context.SecurityContextPersistenceFilter@259d95db, org.springframework.security.web.header.HeaderWriterFilter@de089e0b, org.springframework.security.web.authentication.logout.LogoutFilter@8b86b4c, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@96304ca8, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@1d5b7e4b, org.springframework.security.web.session.SessionManagementFilter@bd586b4d, org.springframework.security.web.access.ExceptionTranslationFilter@7cff2571]
  </code></pre>
  
  <p>As you can see, all module's urls are mapped to the same filter chain with this list of filters:  </p>
  
  <pre><code>Security filter chain: [
    WebAsyncManagerIntegrationFilter
    SecurityContextPersistenceFilter
    HeaderWriterFilter
    LogoutFilter
    OAuth2AuthenticationProcessingFilter
    RequestCacheAwareFilter
    SecurityContextHolderAwareRequestFilter
    AnonymousAuthenticationFilter
    SessionManagementFilter
    ExceptionTranslationFilter
    FilterSecurityInterceptor
  ]
  </code></pre>
  
  <p>What I don't understand is why for the other modules the <code>#oauth2.xx</code> expression is not evaluated since the FilterChain is the same?</p>