@EnableWebSecurity(debug = true)
@Configuration
public class WebSecurityConfig {

    @Configuration
    @Order(1)
    static class DefaultWebSecurityConfig extends WebSecurityConfigurerAdapter {

        @Autowired
        private MyBasicAuthenticationEntryPoint authenticationEntryPoint;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                    .antMatchers("/api/**", "/api2/**").authenticated()
                    .and()
                    .httpBasic()
                    .authenticationEntryPoint(authenticationEntryPoint);
        }
    }

    @Configuration
    @Order(2)
    static class DefaultWebSecurityConfig2 extends WebSecurityConfigurerAdapter {

        @Autowired
        private MyAuthenticationProvider myAuthenticationProvider;


        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .authorizeRequests()
                    .anyRequest().authenticated()
                    .and()
                    .addFilterBefore(new UserAuthenticationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class)
                    .authenticationProvider(myAuthenticationProvider)
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
                    .and()
                    .cors().and()
                    .csrf().disable()
                    .exceptionHandling().authenticationEntryPoint(unauthorizedEntryPoint());
        }

        @Override
        public void configure(WebSecurity web) {
            web.ignoring()
                    .antMatchers(HttpMethod.GET, "/", "/login", "/signup"); //,"/**"
        }


        @Bean
        public AuthenticationEntryPoint unauthorizedEntryPoint() {
            return (request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        }
    }

}

            http
                    .antMatcher("/tasks/**")
                    .authorizeRequests()
//                    .authenticated()
                    .anyRequest().authenticated()
//                    .anonymous().and()
                    .and()

            http
                    .antMatcher("/**")
                    .authorizeRequests()
                    .anyRequest().authenticated()