title: Spring Security HTTP Basic for RESTFul and FormLogin (Cookies) for web - Annotations
body: <p><strong>In Specific</strong></p>
  
  <p>I want to have HTTP Basic authentication ONLY for a specific URL pattern. </p>
  
  <p><strong>In Detail</strong></p>
  
  <p>I'm creating an API interface for my application and that needs to be authenticated by simple <em>HTTP basic authentication</em>. But other web pages should <strong>not</strong> be using HTTP basic but rather a the <em>normal form login.</em></p>
  
  <p><strong>Current Configuration - NOT Working</strong></p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http //HTTP Security
              .csrf().disable() //Disable CSRF
              .authorizeRequests() //Authorize Request Configuration
                  .antMatchers("/connect/**").permitAll()
                  .antMatchers("/", "/register").permitAll()
                  .antMatchers("/admin/**").hasRole("ADMIN")
                  .antMatchers("/api/**").hasRole("API")
                  .anyRequest().authenticated()
              .and() //HTTP basic Authentication only for API
                  .antMatcher("/api/**").httpBasic()
             .and() //Login Form configuration for all others
                  .formLogin().loginPage("/login").permitAll()
              .and() //Logout Form configuration
                  .logout().permitAll();
  
  }
  </code></pre>