title: Understanding requestMatchers() on spring-security
body: <p>I am studying some code of spring-security. I would like to understand this example that I found on internet
  <strong>1</strong>:  </p>
  
  <pre><code>http.requestMatchers()
          .antMatchers("/management/**") // (1)
          .and()
          .authorizeRequests() // (2)
          .antMatchers("/management/health")
          .permitAll()
          .antMatchers("/management/info")
          .permitAll()
          .antMatchers("/management/**")
          .hasRole("ACTUATOR")
          .anyRequest().permitAll()
          .and()
          .httpBasic(); (3)
  </code></pre>
  
  <p>}</p>
  
  <p>I can not understand this configuration, why this code:</p>
  
  <pre><code>http.requestMatchers()
          .antMatchers("/management/**")
          .and() 
  </code></pre>
  
  <p>Is before the .authorizeRequests() ? (1)</p>
  
  <p>What does that mean?</p>
  
  <p>Can you explanation this example?</p>
  
  <p><strong>2:</strong> In the second case, what is the difference?</p>
  
  <pre><code>http.requestMatchers().antMatchers("/rest2/**")
  .and()
  .authorizeRequests()
  .antMatchers("/rest/v1/test/hello").permitAll()
  .antMatchers("/rest/v1/test/**").denyAll()
  .and()
  .requestMatchers().antMatchers("/rest/**")
  .and()
  .authorizeRequests()
  .antMatchers("/rest/v1/test/hello").permitAll();
  </code></pre>
  
  <p>What is the impact using requestMatchers()?</p>
  
  <p>If I send a request to "/rest/v1/test/hello2" I received a 401 Why if the rule that deny a request does not match with the antMatchers("/rest2/**") ?</p>