title: Spring Security add filter to all Endpoint EXCEPT one
body: <p>I researched this and found this <a href="https://stackoverflow.com/questions/45820372/how-to-add-a-filter-only-for-one-special-path-websecurityconfigureradapter/45822153#">Answer</a> on SO.</p>
  
  <p>I do however have the complementary question to this one:</p>
  
  <p>I have a set of filters, that i want to be applied to ALL requests, EXCEPT special cases (eg.: all paths except /mgmt/** and /error/**).</p>
  
  <p>This cannot be done using the same method presented in the linked answer, as I would add the filters to the default http-security Object, which would then apply for the special cases too.</p>
  
  <p>is there a thing like "negative matchers", allowing me to do something like:</p>
  
  <pre><code>http.negativeAntMatchers("/mgmt/**).addFilter(...)
  </code></pre>
  
  <p>to add a filter for everything except /mgmt/** ?</p>
  
  <p>my code:</p>
  
  <p>This is the config for "/mgmt", placing the ManagementBasicAuthFilter in the chain - this works, as no endpoints except "/mgmt/**" ask for basic auth.</p>
  
  <pre><code>@Order(1)
  @Configuration
  @RequiredArgsConstructor
  public static class ManagementSecurityConfig extends WebSecurityConfigurerAdapter {
  
      private final AuthenticationManager authenticationManager;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
              http.antMatcher("mgmt/**")
                  .csrf().disable()
                  .headers().frameOptions().sameOrigin()
                  .cacheControl().disable()
                  .and()
                      .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                  .and()
                      .addFilterBefore(new ManagementBasicAuthenticationFilter(authenticationManager,
                          getAuthenticationEntryPoint(), "/mgmt"), BasicAuthenticationFilter.class)
                      .authorizeRequests()
                      .anyRequest()
                      .permitAll();
      }
  
      private BasicAuthenticationEntryPoint getAuthenticationEntryPoint() {
          BasicAuthenticationEntryPoint entryPoint = new BasicAuthenticationEntryPoint();
          entryPoint.setRealmName("myApp");
          return entryPoint;
      }
  }
  </code></pre>
  
  <p>This is the config for all entrypoints, EXCEPT mgmt - all filters in this file should NOT apply to /mgmt/**</p>
  
  <pre><code>@Order(2)
  @Configuration
  @RequiredArgsConstructor
  @Import({ ResourceServerTokenServicesConfiguration.class })
  @EnableOAuth2Client
  public static class OAuthSecurityConfig extends WebSecurityConfigurerAdapter {
  
      private final OAuth2ClientContextFilter clientContextFilter;
      private final OAuth2ClientAuthenticationProcessingFilter ssoFilter;
      private final StatePropagatingLoginRedirectFilter statePropagatingLoginRedirectFilter;
  
  
      @Override
      public void configure(WebSecurity web) {
        web.ignoring().antMatchers("/mgmt/**");
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .csrf().disable()
                  .headers().frameOptions().sameOrigin()
                  .cacheControl().disable()
                  .and()
                      .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                  .and()
                      .exceptionHandling()
                          .defaultAuthenticationEntryPointFor(
                              new LoginUrlAuthenticationEntryPoint("/login"),
                              request -&gt; true)
                  .and()
                  .addFilterAfter(statePropagatingLoginRedirectFilter, AbstractPreAuthenticatedProcessingFilter.class)
                  .addFilterAfter(ssoFilter, statePropagatingLoginRedirectFilter.getClass())
                  .addFilterAfter(clientContextFilter, ssoFilter.getClass())
                  .authorizeRequests()
                  .anyRequest()
                  .authenticated();
      }
  }
  </code></pre>
  
  <p>When i Request eg.: "/mgmt/health", i get prompted for basic auth, but after login, the filters in the (statePropagating, sso, clientContext) still get applied - why is this?</p>