Spring Security HTTP Basic for RESTFul and FormLogin (Cookies) for web - Annotations

Question

In Specific

I want to have HTTP Basic authentication ONLY for a specific URL pattern.

In Detail

I'm creating an API interface for my application and that needs to be authenticated by simple HTTP basic authentication. But other web pages should not be using HTTP basic but rather a the normal form login.

Current Configuration - NOT Working

@Override protected void configure(HttpSecurity http) throws Exception {     http //HTTP Security             .csrf().disable() //Disable CSRF             .authorizeRequests() //Authorize Request Configuration                 .antMatchers("/connect/**").permitAll()                 .antMatchers("/", "/register").permitAll()                 .antMatchers("/admin/**").hasRole("ADMIN")                 .antMatchers("/api/**").hasRole("API")                 .anyRequest().authenticated()             .and() //HTTP basic Authentication only for API                 .antMatcher("/api/**").httpBasic()            .and() //Login Form configuration for all others                 .formLogin().loginPage("/login").permitAll()             .and() //Logout Form configuration                 .logout().permitAll();  } 

Answer 1

Waited for 2 days and didn't get any help here. But my research provided me a solution :)

Solution

@Configuration @EnableWebMvcSecurity @EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true, proxyTargetClass = true) public class WebSecurityConfig extends WebSecurityConfigurerAdapter{      @Autowired     private AuthenticationProvider authenticationProvider;      @Autowired     public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {         auth.authenticationProvider(authenticationProvider);     }      @Configuration     @Order(1)     public static class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter{         @Override         protected void configure(HttpSecurity http) throws Exception {             http.csrf().disable()                     .antMatcher("/api/**")                     .authorizeRequests()                         .anyRequest().hasAnyRole("ADMIN", "API")                         .and()                     .httpBasic();         }     }      @Configuration     @Order(2)     public static class FormWebSecurityConfig extends WebSecurityConfigurerAdapter{          @Override         public void configure(WebSecurity web) throws Exception {             web.ignoring().antMatchers("/css/**", "/js/**", "/img/**", "/lib/**");         }          @Override         protected void configure(HttpSecurity http) throws Exception {             http.csrf().disable() //HTTP with Disable CSRF                     .authorizeRequests() //Authorize Request Configuration                         .antMatchers("/connect/**").permitAll()                         .antMatchers("/", "/register").permitAll()                         .antMatchers("/admin/**").hasRole("ADMIN")                         .anyRequest().authenticated()                         .and() //Login Form configuration for all others                     .formLogin()                         .loginPage("/login").permitAll()                         .and() //Logout Form configuration                     .logout().permitAll();         }     } }