How to allow “/api/**” through my basic auth config and into my oauth config in Spring Security
I have an app that uses both Basic Auth and OAuth2. Some URLs are authorized using Basic Auth and "/api/**" is authorized using OAuth2. Currently, I have two Java config files ( WebSecurityConfigurerAdapter and ResourceServerConfigurerAdapter ) Each of the config files define a public void configure(HttpSecurity http) method. The trouble I'm having is that I need an elegant way to tell my app whether to use basic auth or oauth2 given the url request. Currently I'm using requestMatchers to make this happen: @EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter {