title: Spring Webflux Security Allow All But One Url
body: <p>I want to allow all urls defined in a specific controller except one.</p>
  
  <p>Let's say my controller exposes 3 urls with base url <code>/users</code></p>
  
  <ol>
  <li>"/" list all users</li>
  <li>"/{id}" list user by id</li>
  <li>"/admin" get admin level details of user.</li>
  </ol>
  
  <p>I want to allow access to 1 and 2 urls to any user except the last one.</p>
  
  <p>I have been doing something like this </p>
  
  <pre><code>@Bean
  public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
      http.authorizeExchange()
          .pathMatchers("/users/**")
          .permitAll()
          .pathMatchers("/users/admin")
          .hasRole("ADMIN")
          .anyExchange()
          .authenticated()
          .and()
          .httpBasic()
          .and()
          .formLogin();
      return http.build();
  }
  </code></pre>
  
  <p>But it is not working. I have tried the reverse also i.e.</p>
  
  <pre><code>@Bean
  public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
      http.authorizeExchange()
          .pathMatchers("/users/admin")
          .hasRole("ADMIN")
          .anyExchange()
          .authenticated()
          .pathMatchers("/users/**")
          .permitAll()
          .and()
          .httpBasic()
          .and()
          .formLogin();
      return http.build();
  }
  </code></pre>
  
  <p>This is also not working stating that since <code>anyExchange()</code> is already registered next <code>pathMatcher</code> can't be reached.</p>