What is the reason to use requestMatchers().antMatchers() without a verb in spring security?

Question

There is a common practice in the Spring security oauth implementation to secure the oauth endpoints with the following line:

.requestMatchers().antMatchers("/login", "/oauth/authorize", "/oauth/confirm_access")

The entire setup looks like this:

http
  .formLogin().loginPage("/login").permitAll()
  .and()
  .requestMatchers().antMatchers("/login", "/oauth/authorize", "/oauth/confirm_access")
  .and()
  .authorizeRequests().anyRequest().authenticated();

Can someone explain me why that specific line is needed, since the next line explicitly says that all the requests have to be authenticated?

Answer 1

The requestMatchers line specifies to which requests the security check applies. The authorizeRequests line does the actual security check.

If you leave out the requestMatchers line, all requests will get checked in the way authorizeRequests specifies. If there are no checks for some requests, checking will succeed by default.

With the requestMatchers line, requests that don't match will get checked by the other remaining chains.