spring-boot restricted url - spring-security

Question

Good day,
I have a spring-boot 1.1.4.RELEASE app,that is using spring-security included as dependencies such as:
compile("org.springframework.boot:spring-boot-starter-security")
compile("org.springframework.security:spring-security-web:4.0.0.M1")
compile("org.springframework.security:spring-security-config:4.0.0.M1")
compile('org.thymeleaf.extras:thymeleaf-extras-springsecurity3:2.1.1.RELEASE')
I have two types of roles: "User" and "Admin". The latter has everything the former, but also access to an administration screen. In my Thymeleaf page, I only display that link to users with an Admin role via, which works just fine:
<li sec:authorize="hasRole('ADMIN')">
<i class="fa fa-link"></i><a th:href="#{/admin}">
Administer User</a>
</li>
However, if I manually type in the url to that page (http://localhost:9001/admin), all roles can access it. I thought i was controlling this via the Security Configuration class:
#Configuration
#EnableWebMvcSecurity
public class ApplicationSecurity extends WebSecurityConfigurerAdapter {
#Autowired
private CustomUserDetailsService customUserDetailsService;
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers( "/" ).permitAll()
.antMatchers("/admin/").hasRole("ADMIN") <== also tried .antMatchers("/admin/**").hasRole("ADMIN")
.antMatchers( "/resources/**" ).permitAll()
.antMatchers( "/css/**" ).permitAll()
.antMatchers( "/libs/**" ).permitAll();
http
.formLogin().failureUrl( "/login?error" )
.defaultSuccessUrl( "/" )
.loginPage( "/login" )
.permitAll()
.and()
.logout().logoutRequestMatcher( new AntPathRequestMatcher( "/logout" ) ).logoutSuccessUrl( "/" )
.permitAll();
http
.sessionManagement()
.maximumSessions( 1 )
.expiredUrl( "/login?expired" )
.maxSessionsPreventsLogin( true )
.and()
.sessionCreationPolicy( SessionCreationPolicy.IF_REQUIRED )
.invalidSessionUrl( "/" );
http
.authorizeRequests().anyRequest().authenticated();
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
PasswordEncoder encoder = new BCryptPasswordEncoder();
auth.userDetailsService( customUserDetailsService ).passwordEncoder( encoder );
}
}
Is there something missing or incorrect in my configuration?
Update:
The solution I used, based upon Dave's answer was to use the following three lines:
.antMatchers( "/admin**" ).hasAuthority("ADMIN" )
.antMatchers( "/admin/" ).hasAuthority( "ADMIN" )
.antMatchers( "/admin/**" ).hasAuthority( "ADMIN" )
This will render a 403 error on the browser. Eventually I will try and get it to redirect to either an error page or "/'.

Answer 1

You only explicitly protected "/admin/" (with a trailing slash). I imagine you need to be more precise than that if you are visiting "/admin" (without a trailing slash).