title: Spring Security JavaConfig: Configure required Channels (secure, insecure, any)
body: <p>I'm trying to serve all static resources (css, javascript and images) through any channel but can't get it to work in combination with <code>.anyRequest().requiresInsecure()</code>:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  @PropertySource("classpath:security.properties")
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
      @Value("${security.auth_urls}")
      private String[] authUrls;
      @Value("${security.secured_urls}")
      private String[] securedUrls;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
                  .antMatchers(authUrls).authenticated()
                  .and()
              .formLogin()
                  .loginPage("/login.html")
                  .permitAll()
                  .and()
              .logout()
                  .logoutUrl("/logout.html")
                  .permitAll()
                  .and()
              .requiresChannel()
                  .antMatchers("/resources/**,/res/**").requires(ChannelDecisionManagerImpl.ANY_CHANNEL)
                  .antMatchers(securedUrls).requiresSecure()
                  .anyRequest().requiresInsecure();
      }
  
      // ...
  }
  </code></pre>
  
  <p>When commenting out <code>.anyRequest.requiresInsecure()</code> it works.</p>
  
  <p>I would like to serve specific pages with HTTPS, all other pages with HTTP and static resources with both.</p>