HttpSecurity configuration - permit all still requires basic auhthentication

Question

I'm trying to add an unsecured controller endpoint /foo/bar to my application, but whenever I try calling it, I get 401 Unauthorized.

Here's my WebSecurityConfigurerAdapter:

http
    .authorizeRequests()
        .antMatchers("/foo/**").permitAll()
    .and()
    .formLogin()
        .loginPage("/login").permitAll()
    .and()
    .requestMatchers()
        .antMatchers("/login", "/oauth/authorize", "/oauth/confirm_access")
    .and()
    .authorizeRequests()
        .anyRequest().authenticated();

Would somone kindly point out what am I missing?

Answer 1

Concatenate multiple antMatchers in one authorizeRequests section:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
                .antMatchers("/foo/**").permitAll()
                .anyRequest().authenticated()
            .and()
            .formLogin().loginPage("/login").permitAll();
}