config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java
public ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry authorizeRequests()
			throws Exception {
		ApplicationContext context = getContext();
		return getOrApply(new ExpressionUrlAuthorizationConfigurer<>(context))
				.getRegistry();
	}
public ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry authorizeRequests()
			throws Exception {
		ApplicationContext context = getContext();
		return getOrApply(new ExpressionUrlAuthorizationConfigurer<>(context))
				.getRegistry();
	}
public ExpressionUrlAuthorizationConfigurer < HttpSecurity > . ExpressionInterceptUrlRegistry authorizeRequests ( ) throws Exception { ApplicationContext context = getContext ( ) ; return getOrApply ( new ExpressionUrlAuthorizationConfigurer <> ( context ) ) . getRegistry ( ) ; }
Allows restricting access based upon the {@link HttpServletRequest} using

<h2>Example Configurations</h2>

The most basic example is to configure all URLs to require the role "ROLE_USER".
The configuration below requires authentication to every URL and will grant access
to both the user "admin" and "user".

<pre>
&#064;Configuration
&#064;EnableWebSecurity
public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {

&#064;Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin();
}

&#064;Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser(&quot;user&quot;).password(&quot;password&quot;).roles(&quot;USER&quot;)
.and().withUser(&quot;admin&quot;).password(&quot;password&quot;).roles(&quot;ADMIN&quot;, &quot;USER&quot;);
}
}
</pre>

We can also configure multiple URLs. The configuration below requires
authentication to every URL and will grant access to URLs starting with /admin/ to
only the "admin" user. All other URLs either user can access.

<pre>
&#064;Configuration
&#064;EnableWebSecurity
public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {

&#064;Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().antMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;)
.antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin();
}

&#064;Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser(&quot;user&quot;).password(&quot;password&quot;).roles(&quot;USER&quot;)
.and().withUser(&quot;admin&quot;).password(&quot;password&quot;).roles(&quot;ADMIN&quot;, &quot;USER&quot;);
}
}
</pre>

Note that the matchers are considered in order. Therefore, the following is invalid
because the first matcher matches every request and will never get to the second
mapping:

<pre>
http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).antMatchers(&quot;/admin/**&quot;)
.hasRole(&quot;ADMIN&quot;)
</pre>

@see #requestMatcher(RequestMatcher)

@return the {@link ExpressionUrlAuthorizationConfigurer} for further customizations
@throws Exception
Allows restricting access based upon the { @link HttpServletRequest } using