title: How to restrict access to html pages based on roles with spring security?
body: <p>I want the users to have access to html pages based on their role. For example only the ones with HR role should be able to view settings.html page and only those who are managers should see pendingrequest.html.</p>
  
  <p>This is my security configuration:</p>
  
  <pre><code>    @Configuration
      @EnableWebSecurity
      @EnableGlobalMethodSecurity(prePostEnabled = true)
      @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
      public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
          @Autowired
          private DatabaseAuthenticationProvider authenticationProvider;
  
  
          @Override
          public void configure(WebSecurity web) throws Exception {
  
              web.ignoring().antMatchers("/js/**", "/css/**", "/img/**");
          }
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http.formLogin().loginPage("/login").failureUrl("/login").defaultSuccessUrl("/")
                      .and().logout().logoutSuccessUrl("/login")
                      .and().authorizeRequests().antMatchers("/login").permitAll()
                      .antMatchers("/settings.html").hasRole("HR")
                      .antMatchers("/pendingRequests.html").hasRole("MANAGER")
                      .antMatchers("/settings.html","/pendingRequests.html").hasRole("ADMIN")
                      .anyRequest().authenticated().and().csrf().disable();
          }
  
  
  
   @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  
          auth.authenticationProvider(authenticationProvider).eraseCredentials(false);
      }
  }
  </code></pre>
  
  <p>For some reason what I've tried there doesn't work, no matter what role I have I cannot see those pages.</p>