title: Users are able to access all endpoints after setting antMachers in Spring Security
body: <p>I'm developing a spring-boot application and its spring security configuration is as follows:</p>
  
  <pre><code>@EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter  {
  @Override
      protected void configure(HttpSecurity httpSecurity) throws Exception {
          httpSecurity
              .authorizeRequests()
              .antMatchers("/actuator/**", "/login*", "/logout*")
              .permitAll();
  
          httpSecurity
              .cors().and()
              .csrf().disable()
              .authorizeRequests()
              .antMatchers("/").permitAll()
              .antMatchers("/taas/v1/**").hasRole("admin")
              .antMatchers("/taas/v1/teams", "/taas/v1/profiles", "/taas/v1/tests/summary").hasRole("tester")
              .antMatchers( "/taas/v1/teams", "/taas/v1/tests/summary").hasRole("user")
              .anyRequest().authenticated()
              .and()
              .exceptionHandling().accessDeniedHandler(customAccessDeniedHandler)
              .and()
              .httpBasic()
              .and()
              .formLogin()
              .successHandler(customAuthenticationSuccessHandler)
              .failureHandler(customAuthenticationFailureHandler)
              .and()
              .logout()
                  .logoutSuccessHandler(customLogoutSuccessHandler())
                  .invalidateHttpSession(true)
                  .deleteCookies("JSESSIONID");
      }
  }
  </code></pre>
  
  <p>Even though  i have set the url pattern for each roles. All users are able to access all endpoints as mentioned in antMatchers(). A user with role <code>user</code> is not supposed to access <code>/taas/v1/profiles</code>. But when I try to access that endpoint by logging in as <code>user</code>, I'm getting the response but expected response is <code>403 forbidden</code>.</p>
  
  <p>I request someone to provide a workaround for me.</p>