title: Enforce both correct API Key and JWT User Token in REST API with Spring Boot Security
body: <p>I'm currently working on an REST API in Spring Boot.</p>
  
  <p>Multiple People shall build clients for this API, so I want to distinguish them by API Keys.</p>
  
  <p>Also users are able to login to the service via an authorization process to get a JWT (I know that's not very RESTful, but that's the best way I can think of doing it).</p>
  
  <p>I implemented three filter classes for these purposes:</p>
  
  <ul>
  <li><code>APIKeyAuthFilter extends AbstractPreAuthenticatedProcessingFilter</code></li>
  <li><code>JWTAuthenticationFilter extends UsernamePasswordAuthenticationFilter</code></li>
  <li><code>JWTAuthorizationFilter extends BasicAuthenticationFilter</code></li>
  </ul>
  
  <p>and everything works quite nice individually.</p>
  
  <p>The problem is, that the security layer treats both Auth Types equally. So e.g. I can get stuff only users should see via only an API Key and there is no need for an API-Key once I have a JWT.</p>
  
  <p>I guess the problem lies in this code in my subclass of <code>WebSecurityConfigurerAdapter</code>:</p>
  
  <pre><code>httpSecurity
      .antMatcher("/**")
      .csrf().disable()
      .sessionManagement()
      .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
      .and()
      .addFilter(new JWTAuthenticationFilter(authenticationManager()))
      .addFilter(apiKeyFilter)
      .addFilter(new JWTAuthorizationFilter(authenticationManager()))
      .authorizeRequests().anyRequest().authenticated();
  </code></pre>
  
  <p>Or is my whole approach wrong and I need to add API Keys in a whole different way?</p>