title: Spring Security Configuration @Order not unique exception
body: <p>I've tried to register multiple filters in my Spring Security Configuration, however I always get the same exception:</p>
  
  <blockquote>
    <p>04-Nov-2015 14:35:23.792 WARNING [RMI TCP Connection(3)-127.0.0.1]
    org.springframework.web.context.support.AnnotationConfigWebApplicationContext.refresh
    Exception encountered during context initialization - cancelling
    refresh attempt 
    org.springframework.beans.factory.BeanCreationException: Error
    creating bean with name
    'org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration':
    Injection of autowired dependencies failed; nested exception is
    java.lang.IllegalStateException: @Order on WebSecurityConfigurers must
    be unique. Order of 100 was already used, so it cannot be used on
    com.payment21.webapp.MultiHttpSecurityConfig$ApiWebSecurityConfigurationAdapter$$EnhancerBySpringCGLIB$$35c79fe4@1d381684
    too.</p>
  </blockquote>
  
  <p>Since my own attempts didn't work, I tried the <strong>exact same code</strong> as shown in the <a href="https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#multiple-httpsecurity" rel="noreferrer">Spring Security reference</a>:</p>
  
  <pre><code>@EnableWebSecurity
  public class MultiHttpSecurityConfig {
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) { 
          auth
              .inMemoryAuthentication()
                  .withUser("user").password("password").roles("USER").and()
                  .withUser("admin").password("password").roles("USER", "ADMIN");
      }
  
      @Configuration
      @Order(1)                                                        
      public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
          protected void configure(HttpSecurity http) throws Exception {
              http
                  .antMatcher("/api/**")                               
                  .authorizeRequests()
                      .anyRequest().hasRole("ADMIN")
                      .and()
                  .httpBasic();
          }
      }
  
      @Configuration                                                   
      public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http
                  .authorizeRequests()
                      .anyRequest().authenticated()
                      .and()
                  .formLogin();
          }
      }
  }
  </code></pre>
  
  <p>To isolate the error I tried to replace the web.xml by a Java based approach, but it didn't work either. I have no idea what's wrong, is the doc wrong? Can something in my application mess with the configuation? System is starting up properly, unless I register a second WebSecurityConfigAdapter.</p>
  
  <p>Those are my dependencies:</p>
  
  <pre><code>compile 'org.springframework:spring-webmvc:4.2.2.RELEASE'
  compile 'org.springframework:spring-messaging:4.2.2.RELEASE'
  compile 'org.springframework:spring-websocket:4.2.2.RELEASE'
  compile 'org.springframework:spring-aop:4.2.2.RELEASE'
  compile'javax.servlet:javax.servlet-api:3.0.1'
  compile 'org.springframework.security:spring-security-web:4.0.3.RELEASE'
  compile 'org.springframework.security:spring-security-config:4.0.3.RELEASE'
  </code></pre>