title: SpringBoot Security Does not Whitelist Login Endpoints
body: <p>I have been trying to get a sample SpringBoot app up and running along with SpringBoot Security+JWT helping me handle the security situation. (The source code can be found here: <a href="https://github.com/vaddipar/groclist" rel="nofollow noreferrer">https://github.com/vaddipar/groclist</a>)</p>
  
  <p>I have followed <a href="https://youtu.be/X80nJ5T7YpE?list=WL" rel="nofollow noreferrer">https://youtu.be/X80nJ5T7YpE?list=WL</a> tutorial religiously and setup the entire SpringBoot Security configuration.</p>
  
  <p>Now, I achieved half of my goal which is to add security but I am unable to whitelist the Login and Register endpoints.</p>
  
  <p>My <em>WebSecurityConfig</em> is given below. It has the configuration to whitelist the login and register endpoints but it does not work. Can someone take a look and let know what is going wrong here.</p>
  
  <pre><code>@EnableWebSecurity
  class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      @Autowired
      private UserDetailsService myUserDetailsService;
      @Autowired
      private JwtRequestFilter jwtRequestFilter;
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(myUserDetailsService);
      }
  
      @Bean
      public PasswordEncoder passwordEncoder() {
          return NoOpPasswordEncoder.getInstance();
      }
  
      @Override
      @Bean
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Override
      protected void configure(HttpSecurity httpSecurity) throws Exception {
          httpSecurity.csrf().disable()
                  .anonymous().and()
                  .authorizeRequests().antMatchers("/login").permitAll().and()
                  .authorizeRequests().antMatchers("/register").permitAll()
                  .anyRequest().authenticated()
                  .and()
                  .exceptionHandling().and().sessionManagement()
                  .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
          httpSecurity.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
  
      }
  
  }
  </code></pre>