java - how to solve Spring Security can access url without login -

hi have created sample spring mvc security application.i'm following java code based configuration rather xml configuration.the application working fine. , user can access each , every url without login application. how can resolve problems??

i want , users must not access url without login process.

@enablewebsecurity @configuration public class websecurityconfig extends websecurityconfigureradapter {      @autowired     private customuserdetailsservice customuserdetailsservice;      @override     protected void configure(httpsecurity http) throws exception {         http.csrf().disable()                 .headers()                 .addheaderwriter(new xframeoptionsheaderwriter(xframeoptionsheaderwriter.xframeoptionsmode.sameorigin)).and()                 .formlogin().defaultsuccessurl("/admin/home")                 .loginpage("/login").failureurl("/login?error")                 .permitall().and().logout()                 .logoutsuccessurl("/login?logout").logouturl("/logout")                 .permitall().and().authorizerequests().antmatchers("/**")                 .permitall().anyrequest().authenticated().and();     }      /*      * @override protected void configure(authenticationmanagerbuilder auth)      * throws exception      */     @override     protected void configure(authenticationmanagerbuilder auth)             throws exception {         auth.userdetailsservice(customuserdetailsservice);     }  } 

firstly include

@autowired public void configureglobal(authenticationmanagerbuilder auth) throws exception {     auth         .inmemoryauthentication()             .withuser("admin").password("password").roles("admin"); // admin in case } 

and @bohuslav burghardt suggested use

 http      .authorizerequests()                                                                      .antmatchers("/resources/**", "/login").permitall()         .antmatchers("/admin/**").hasrole("admin")      .and()       .formlogin()         .loginpage("/login")         .defaultsuccessurl("/admin/home")         .failureurl("/loginfailed")                      .permitall()         .and()      .logout()         .logoutrequestmatcher(new antpathrequestmatcher("/logout"))         .deletecookies("jsessionid")         .invalidatehttpsession( true )         .and();