title: Failing to configure two HttpSecurity setups with JavaConfig
body: <p>I have followed the advice from the <a href="http://docs.spring.io/spring-security/site/docs/3.2.4.RELEASE/reference/htmlsingle/#multiple-httpsecurity" rel="nofollow">official documentation</a> on how to configure two separate <code>HttpSecurity</code> instances:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SoWebSecurityConfig
  {
    @Autowired public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth.userDetailsService(username -&gt; {
        log.info("\n\n\n *********  authenticating {} ************************************\n\n\n", username);
        return new User(username, "", asList(new SimpleGrantedAuthority("TV")));
      });
    }
  
    @Configuration
    @Order(1)
    public static class SwiperSecurityConfig extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception { configureHttpSec(http, "/swiper"); }
    }
  
    @Configuration
    @Order(2)
    public static class TvSecurityConfig extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception { configureHttpSec(http, "/tv"); }
    }
  
    static HttpSecurity configureHttpSec(HttpSecurity http, String urlBase) throws Exception {
      http   .csrf().disable()
             .exceptionHandling().authenticationEntryPoint(new Http403ForbiddenEntryPoint())
      .and() .authorizeRequests().antMatchers(urlBase+"/**").authenticated()
      .and() .httpBasic()
      .and() .logout().logoutUrl(urlBase+"/logout").logoutSuccessHandler((req,resp,auth) -&gt; {})
      ;
      return http;
    }
  }
  </code></pre>
  
  <p>In the logs I do see two filter chains being created:</p>
  
  <pre><code>2014-06-30 12:44:22 main INFO  o.s.s.w.DefaultSecurityFilterChain - Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.as
  ync.WebAsyncManagerIntegrationFilter@806996, org.springframework.security.web.context.SecurityContextPersistenceFilter@1937eaff, org.springframework.security.web.header.HeaderWriterFilter@71e4b308, org.springfr
  amework.security.web.authentication.logout.LogoutFilter@1d1cbd0f, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@9b9a327, org.springframework.security.web.savedrequest.RequestCach
  eAwareFilter@4993febc, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@67064bdc, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@78b612c6, org.s
  pringframework.security.web.session.SessionManagementFilter@6d11ceef, org.springframework.security.web.access.ExceptionTranslationFilter@6e7c351d, org.springframework.security.web.access.intercept.FilterSecurit
  yInterceptor@571a01f9] 
  2014-06-30 12:44:22 main INFO  o.s.s.w.DefaultSecurityFilterChain - Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.as
  ync.WebAsyncManagerIntegrationFilter@30c1da48, org.springframework.security.web.context.SecurityContextPersistenceFilter@427ae189, org.springframework.security.web.header.HeaderWriterFilter@4784efd9, org.spring
  framework.security.web.authentication.logout.LogoutFilter@187e5235, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@514de325, org.springframework.security.web.savedrequest.RequestC
  acheAwareFilter@16a9eb2e, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@76332405, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@43a65cd8, or
  g.springframework.security.web.session.SessionManagementFilter@3fba233d, org.springframework.security.web.access.ExceptionTranslationFilter@376c7d7d, org.springframework.security.web.access.intercept.FilterSecu
  rityInterceptor@3b48e183] 
  </code></pre>
  
  <p>but only the one I designate with <code>Order(1)</code> will actually get used; the URLs matching the other one will not get authenticated.</p>
  
  <p>I have also tried following the docs more closely, using <code>anyRequest()</code> instead of ant matchers for the <code>@Order(2)</code> configuration, but the result was the same.</p>
  
  <p>What are my options to get around this problem?</p>
  
  <p>I am using Spring 4.0.5, Spring Security 3.2.4.</p>