Why specifying full paths to secure when we have a base path? - spring-security

Question

Say we have this configuration:
#RestController
#RequestMatching(("/private")
class PrivateProductController {
#GetMapping("/products")
Collection<Product> getProducts(){
....
}
#GetMapping("/category")
int getCategory(){
....
}
#GetMapping("/catalog")
Catalogue getCatalogue(){
....
}
}
And an associated security configuration:
#Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.requestMatchers()
.antMatchers("/private/**")
.and()
.authorizedRequests()
.antMatchers("/private/products").hasRole("USER")
.antMatchers("/private/category").authenticated()
.antMatchers("/private/catalog").hasAnyRole("USER","GUEST");
}
}
Since the base path is /private/** I tried to simplify my configuration like this (by removing /private from subpaths):
#Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.requestMatchers()
.antMatchers("/private/**")
.and()
.authorizedRequests()
.antMatchers("/products").hasRole("USER")
.antMatchers("/category").authenticated()
.antMatchers("/catalog").hasAnyRole("USER","GUEST");
}
}
But that simplification does not work. So the question is why do we need to add each time the full path? Since we declared this: http.requestMatchers().antMatchers("/private/**") I thought that all /private subpaths like /products or /category would be managed in this filters chain without prefixing them by /private.
I surelly misconfigured spring security, how to achieve what I would like to do? I mean defining a filters chain matching a base path where all subpaths are protected without needing to prefix them by the root path? Thanks

Answer 1

The pattern you passed to antMatcher method is matched by Spring Security with the request URI i.e. request.getServletPath()+request.getPathInfo()+request.getQueryString()
When you provide just /products instead of /private/products , the pattern doesn't match and it fails.