title: Secure an Angular JS app with Spring Security
body: <p>I have created a Spring Boot app and I have my front-end app in the <code>/resources/static</code> folder.  </p>
  
  <p>For the routing, I am using Angular JS UI Router library.
  I have defined a route, which I only want to be accessed by the admin and now I am trying to secure it using Spring Security.  </p>
  
  <p>Here is my WebSecurity Configuration class: </p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter  {
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth
          .inMemoryAuthentication()
              .withUser("user").password("password").roles("USER").and()
              .withUser("admin").password("password").roles("USER", "ADMIN");
  }
  
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
        .authorizeRequests()
        .antMatchers(HttpMethod.GET, "/#/admin").hasRole("ADMIN")
        .and()
        .formLogin()
        .and()
        .authorizeRequests()
        .antMatchers(HttpMethod.POST, "/member", "/member/**").permitAll()
        .antMatchers(
                HttpMethod.GET,
                "/",
                "/*.html",
                "/favicon.ico",
                "/**/*.html",
                "/**/*.css",
                "/**/*.js",
                "/**/**/*.css",
                "/**/**/*.js",
                "/**/**/*.html",
                "/**/**/**/*.css",
                "/**/**/**/*.js",
                "/**/**/**/*.html",
                "/**/**/**/**/*.css",
                "/**/**/**/**/*.js"          
        ).permitAll()
        .antMatchers("/auth/**",  "/member/**", "/account/**").permitAll() 
  
        .and()
        .csrf().disable();
  
    }
   }
  </code></pre>
  
  <p>The route I am trying to secure can be accessed through <a href="http://localhost:8080/#/admin" rel="nofollow noreferrer">http://localhost:8080/#/admin</a>.<br>
   However, whenever I am accessing that route, no login is requested and the page can be viewed by anyone.<br>
  Is it there another approach I should follow?</p>