title: How can I tell spring security to apply authorizeRequests just for a specific port?
body: <p>We configured our new micro service (using Spring-Boot) in a way that the official API is on port 8080 (which is be mapped outside of our virtual network to normal HTTPS on port 443), while some management functions are on a secondary HTTP port 7979. These are only used inside the virtual network, and used for monitoring, loadbalancing etc.</p>
  
  <p>All API access needs to be secured with OAuth, while the management functions should be accessible freely inside the network. So we configured Spring security this way (http is a HttpSecurity object):</p>
  
  <pre><code>    http
          .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
          .and()
          .authorizeRequests()
              .antMatchers("/info").anonymous()
              .antMatchers("/health").anonymous()
  
              .antMatchers(HttpMethod.GET, "/warehouses/**").access(oauthScopeRead)
              .antMatchers(HttpMethod.PUT, "/warehouses/**").access(oauthScopeWrite)
  
              .anyRequest().denyAll();
  </code></pre>
  
  <p>This has the effect on both ports: <code>/info</code> and <code>/health</code> are unauthorized, while <code>/warehouses</code> needs authentication, and everything else also needs authentication (returns 401, but when invoking with authentication, it returns 403).</p>
  
  <p>As there is no <code>/info</code> or <code>/health</code> on the public port, these return 404 for unauthorized users, while everything else returns 401. I'm unsatisfied with this and would like to have</p>
  
  <ul>
  <li>on the public port, require authentication for everything (and return 404 or 403 only after being authenticated)</li>
  <li>on the admin port, require no authentication at all (return 404 for everything which is not one of the configured endpoints).</li>
  </ul>
  
  <p>I couldn't find anything about ports in the Spring Security Javadocs or <a href="http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/" rel="noreferrer">reference documentation</a>.</p>
  
  <p>What can I do here?</p>