title: how to setup different access for nested url's in spring-security
body: <p>here is my security config:</p>
  
  <pre><code>protected void configure(HttpSecurity http) throws Exception {
  
  
          http.authorizeRequests().antMatchers("**/feedback")
                  .access("hasAnyAuthority('MANAGER','EMPLOYEE')")
                  .and().authorizeRequests().antMatchers("/api/**","/ticket/**")
                  .access("isAuthenticated()")
                  .and().authorizeRequests().antMatchers("**/create/**")
                  .access("hasAnyAuthority('MANAGER','EMPLOYEE')")
                  .and().formLogin().loginPage("/login").failureUrl("/login?error")
                  .and().formLogin().defaultSuccessUrl("/ticket/all", true)
                  .usernameParameter("email")
                  .passwordParameter("password")
                  .and().csrf().disable();
      }
  </code></pre>
  
  <p>i want everyone to have access for viewing tickets "/ticket" , but i want to forbid access for an engineer to /ticket/create and /ticket/**/feedback. Right now </p>
  
  <pre><code>antMatchers("/api/**","/ticket/**")
                      .access("isAuthenticated()")
  </code></pre>
  
  <p>Allows to access everyone. How should i do it properly? Is there some kind of overwriting rule for multiple antMatchers?</p>