Multiple antMatchers in Spring security -

i work on content management system, has 5 antmatchers following:

http.authorizerequests()         .antmatchers("/", "/*.html").permitall()         .antmatchers("/user/**").hasrole("user")         .antmatchers("/admin/**").hasrole("admin")         .antmatchers("/admin/login").permitall()         .antmatchers("/user/login").permitall()         .anyrequest().authenticated()         .and()         .csrf().disable(); 

which suppose mean visitors can see site @ root path (/*), , users can see (/user), admin can see (/admin), , there 2 login pages 1 users , admin.

the code seems work fine, except admin section - doesn't work return access denied exception.

i believe problem in order of rules:

.antmatchers("/admin/**").hasrole("admin") .antmatchers("/admin/login").permitall() 

the order of rules matters , more specific rules should go first. starts /admin require authenticated user admin role, /admin/login path (because /admin/login matched /admin/** rule , therefore second rule ignored).

the rule login page should therefore go before /admin/** rule. e.g.

.antmatchers("/admin/login").permitall() .antmatchers("/admin/**").hasrole("admin")