Nested exception is java.lang.IllegalStateException: Can't configure antMatchers after anyRequest - spring-boot

Question

I am trying this code but get this exception:nested exception is:
java.lang.IllegalStateException: Can't configure antMatchers after anyRequest.
Java code
package com.cris.cms.config;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
#Configuration
#EnableWebSecurity
#EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
private UserDetailsService userDetailsService;
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(encodePWD());
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable(); http.authorizeRequests().antMatchers("/rest/**").authenticated().anyRequest().permitAll().and()
.authorizeRequests().antMatchers("/secure/**").authenticated().anyRequest().hasAnyRole("ADMIN").and()
.formLogin().permitAll();
}
#Bean
public BCryptPasswordEncoder encodePWD() {
return new BCryptPasswordEncoder();
}
}

Answer 1

You don't need to call .authorizeRequests() multiple times but even if you call it, it is not an error. If you remove the .authorizeRequests() multiple calls, and format it, it would be look as follows:
protected void configure(HttpSecurity http) throws Exception {
http.csrf()
.disable()
.authorizeRequests()
.antMatchers("/rest/**").authenticated()
.anyRequest().permitAll()
.antMatchers("/secure/**").authenticated()
.anyRequest().hasAnyRole("ADMIN")
.and()
.formLogin()
.permitAll();
}
So now think of it as of multiple if else if else like below
if (condition1) {
doX();
} else if (condition2) {
doY();
} else {
doZ()
}
As it self explains, anyRequest() will evaluate to true always. So if you put anyRequest() as the first condition, it will never go past the first if block. So you always have to put anyRequest() as the last line within authorizeRequests()
So put specific urls matching first. If you have antMatchers("/rest/**") and antMatchers("**"), you have to put antMatchers("/rest/**")
Similarly you cannot have more than one else blocks because it is the last one without condition. You have to remove one of .anyRequest().permitAll() or .anyRequest().hasAnyRole("ADMIN")
So it will become
protected void configure(HttpSecurity http) throws Exception {
http.csrf()
.disable()
.authorizeRequests()
.antMatchers("/rest/**").authenticated()
.antMatchers("/secure/**").authenticated()
.antMatchers("/admin specific url").hasAnyRole("ADMIN")
.anyRequest().permitAll()
.and()
.formLogin()
.permitAll();
}