java - Spring Security multiple url ruleset not working together -

i have http spring security configuration appears work when comment out each individual aspect doesn't work when combine spring security rules together, know problem not regexmatcher or antmatcher rules applied in combination.

here spring security class:

package com.driver.website.config;  import org.springframework.beans.factory.annotation.autowired; import org.springframework.beans.factory.annotation.value; import org.springframework.context.annotation.bean; import org.springframework.context.annotation.configuration; import org.springframework.security.config.annotation.authentication.builders.authenticationmanagerbuilder; import org.springframework.security.config.annotation.method.configuration.enableglobalmethodsecurity; import org.springframework.security.config.annotation.web.builders.httpsecurity; import org.springframework.security.config.annotation.web.builders.websecurity; import org.springframework.security.config.annotation.web.configuration.enablewebsecurity; import org.springframework.security.config.annotation.web.configuration.websecurityconfigureradapter; import org.springframework.security.web.csrf.csrftokenrepository; import org.springframework.security.web.csrf.httpsessioncsrftokenrepository; import org.springframework.security.web.header.writers.staticheaderswriter; import org.springframework.security.web.header.writers.frameoptions.xframeoptionsheaderwriter; import org.springframework.security.web.util.matcher.requestmatcher;  import javax.servlet.http.httpservletrequest; import java.security.accesscontrolcontext;  @configuration @enablewebsecurity @enableglobalmethodsecurity(prepostenabled = true) public class securityconfig extends websecurityconfigureradapter {      @value("${widget.headers.xframeoptions.domains.allowed}")     private string allowedxframeoptions;      @value("${widget.headers.origins.allowed}")     private string allowedorigins;      @override     public void configure(httpsecurity http) throws exception {         // @formatter:off          http.exceptionhandling().accessdeniedpage("/login")                 .and()                 .formlogin().loginpage("/login").defaultsuccessurl("/myaccount", true).permitall()                 .and()                 .authorizerequests()                 .antmatchers("/**").permitall();          http.regexmatcher("^((?!(/widget|/assistedsearch)).)*$")                 .headers().frameoptions().disable()                 .regexmatcher("^((?!(/widget|/assistedsearch)).)*$")                 .headers()                 .xssprotection()                 .contenttypeoptions()                 .addheaderwriter(new staticheaderswriter("x-frame-options", "sameorigin"));          http.antmatcher("/widget")             .headers()             .frameoptions()             .disable()             .antmatcher("/widget")             .headers()             .addheaderwriter(new staticheaderswriter("x-frame-options", "allow-from " + allowedxframeoptions));          http.requestmatchers().antmatchers("/assistedsearch", "/widget")             .and()             .headers()             .addheaderwriter(new staticheaderswriter("access-control-allow-origin", allowedorigins))             .addheaderwriter(new staticheaderswriter("access-control-allow-methods", "get, post"))             .addheaderwriter(new staticheaderswriter("access-control-allow-headers", "content-type"));          // @formatter:on     } } 

the rules should be...

• for urls not /widget , /assistedsearch should add sameorigin x-frame-options header
• for /widget endpoint should add x-frame-options: allow-from header
• for /widget , /assistedsearch endpoints should add access-control-allow-origin, access-control-allow-methods , access-control-allow-headers headers

as mentioned above if comment out for urls ruleset other 2 work in unison, for urls rule uncommented none of headers appear.

does have ideas why might be? how add multiple rulesets in spring security , override existing rulesets new ones?

i tried

http.antmatcher("/widget")     .headers()     .frameoptions()     .disable() 

which again appears work on it's own not in combination.

thanks in advance!

you override previous matchers, see httpsecurity.html#antmatcher:

invoking antmatcher(string) override previous invocations of mvcmatcher(string)}, requestmatchers(), antmatcher(string), regexmatcher(string), , requestmatcher(requestmatcher).

and httpsecurity.html#regexmatcher:

invoking regexmatcher(string) override previous invocations of mvcmatcher(string)}, requestmatchers(), antmatcher(string), regexmatcher(string), , requestmatcher(requestmatcher).

if want more 1 configuration of httpsecurity, see spring security reference:

we can configure multiple httpsecurity instances can have multiple <http> blocks. key extend websecurityconfigurationadapter multiple times. example, following example of having different configuration url’s start /api/.

@enablewebsecurity public class multihttpsecurityconfig {   @autowired   public void configureglobal(authenticationmanagerbuilder auth) { 1       auth           .inmemoryauthentication()               .withuser("user").password("password").roles("user").and()               .withuser("admin").password("password").roles("user", "admin");   }    @configuration   @order(1)                                                        2   public static class apiwebsecurityconfigurationadapter extends websecurityconfigureradapter {       protected void configure(httpsecurity http) throws exception {           http               .antmatcher("/api/**")                               3               .authorizerequests()                   .anyrequest().hasrole("admin")                   .and()               .httpbasic();       }   }    @configuration                                                   4   public static class formloginwebsecurityconfigureradapter extends websecurityconfigureradapter {        @override       protected void configure(httpsecurity http) throws exception {           http               .authorizerequests()                   .anyrequest().authenticated()                   .and()               .formlogin();       }   } }