{"action":"opened","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/667","labels_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/667/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/667/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/667/events","html_url":"https://github.com/spring-projects/spring-security-oauth/issues/667","id":124832072,"number":667,"title":"Chaining custom requestMatchers with NotOAuthRequestMatcher by OrRequestMatcher leads to incorrect request filters behaviour","user":{"login":"SkivPragma","id":16546499,"avatar_url":"https://avatars.githubusercontent.com/u/16546499?v=3","gravatar_id":"","url":"https://api.github.com/users/SkivPragma","html_url":"https://github.com/SkivPragma","followers_url":"https://api.github.com/users/SkivPragma/followers","following_url":"https://api.github.com/users/SkivPragma/following{/other_user}","gists_url":"https://api.github.com/users/SkivPragma/gists{/gist_id}","starred_url":"https://api.github.com/users/SkivPragma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SkivPragma/subscriptions","organizations_url":"https://api.github.com/users/SkivPragma/orgs","repos_url":"https://api.github.com/users/SkivPragma/repos","events_url":"https://api.github.com/users/SkivPragma/events{/privacy}","received_events_url":"https://api.github.com/users/SkivPragma/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-01-04T20:29:31Z","updated_at":"2016-01-04T20:29:31Z","closed_at":null,"body":"I have next config:\r\nhttp.requestMatchers()\r\n            .antMatchers(\r\n                    \"/rest/**\", \r\n                    \"/rest_data/**\",\r\n                    \"/upload\")\r\n        .and()\r\n...\r\ninside ResourceServerConfigurerAdapter annotated by @EnableResourceServer\r\n\r\nI have application with 2 authentication mechanisms. Most endpoints use form-based authentication and oauth2 authentication used for 3 endpoints only.\r\n \r\nThis configuration worked fine until I updated spring security from 3.2.7 to 4.0.3.\r\nIt seems that there was a bug related to mulitple invocations of http.requetMatchers(). See https://github.com/spring-projects/spring-security/commit/fbf3672ecaf0497a52c557b7d3a05951be30c7ef\r\nThe filter chain configured for oauth2 secured resources used always for all paths except \"/oauth/check_token\", \"/oauth/authorize\", \"/oauth/confirm_access\", \"/oauth/error\", \"/oauth/token\". NotOAuthRequestMatcher returns true in conjunction with OrRequestMatcher used in HttpSecurity.RequestMatcherConfigurer. This leads to incorrect filter chain application. antMatchers passed in config ignored."}}