Configuring SecurityFilterChain in Spring Security

//BookApiController.java
package com.javabrahman.security.chain;

import java.util.List;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/api")
public class BookApiController {

  @GetMapping("/books")
  public List<String> list() {
    return List.of("Effective Java", "Clean Code");
  }

  @PostMapping("/books")
  public ResponseEntity<String> add(@RequestBody String title) {
    return ResponseEntity.status(201).body("added: " + title);
  }

  @DeleteMapping("/books/{id}")
  public ResponseEntity<Void> delete(@PathVariable long id) {
    return ResponseEntity.noContent().build();
  }

  @GetMapping("/admin/report")
  public String report() {
    return "2 books, 0 loans";
  }
}

//PageController.java
package com.javabrahman.security.chain;

import java.security.Principal;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class PageController {

  @GetMapping("/")
  public String home() {
    return "Welcome";
  }

  @GetMapping("/account")
  public String account(Principal user) {
    return "Account of " + user.getName();
  }
}

//SecurityConfig.java
package com.javabrahman.security.chain;

import static org.springframework.security.config.Customizer.withDefaults;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpMethod;
import org.springframework.http.MediaType;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

  @Bean
  @Order(1)
  SecurityFilterChain apiChain(HttpSecurity http) throws Exception {
    http
        .securityMatcher("/api/**")                       // this chain handles only /api/... requests
        .authorizeHttpRequests(auth -> auth
            .requestMatchers(HttpMethod.GET, "/api/books/**").permitAll()
            .requestMatchers(HttpMethod.POST, "/api/books").hasRole("EDITOR")
            .requestMatchers(HttpMethod.DELETE, "/api/books/*").hasAuthority("books:delete")
            .requestMatchers("/api/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated())
        .httpBasic(basic -> basic.authenticationEntryPoint(jsonEntryPoint()))
        .csrf(csrf -> csrf.disable())                     // no browser sessions here, see below
        .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
    return http.build();
  }

  @Bean
  @Order(2)
  SecurityFilterChain webChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/", "/error").permitAll()
            .anyRequest().authenticated())
        .formLogin(withDefaults());
    return http.build();
  }

  // A JSON 401 for API clients, instead of the default empty body
  private AuthenticationEntryPoint jsonEntryPoint() {
    return (request, response, exception) -> {
      response.setStatus(401);
      response.setContentType(MediaType.APPLICATION_JSON_VALUE);
      response.setCharacterEncoding("UTF-8");
      response.getWriter().write("{\"error\":\"authentication required\",\"path\":\"" + request.getRequestURI() + "\"}");
    };
  }

  @Bean
  UserDetailsService users() {
    return new InMemoryUserDetailsManager(
        User.withUsername("ann").password("{noop}ann-pass").roles("USER").build(),
        User.withUsername("eve").password("{noop}eve-pass").roles("USER", "EDITOR").build(),
        User.withUsername("raj").password("{noop}raj-pass").authorities("ROLE_ADMIN", "books:delete").build());
  }
}

//ChainApp.java
package com.javabrahman.security.chain;

import java.util.Arrays;
import org.springframework.boot.CommandLineRunner;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.Bean;
import org.springframework.security.web.DefaultSecurityFilterChain;
import org.springframework.security.web.FilterChainProxy;

@SpringBootApplication
public class ChainApp {

  @Bean
  CommandLineRunner listChains(FilterChainProxy proxy, ApplicationContext context) {
    return args -> {
      if (!Arrays.asList(args).contains("list-chains")) {
        return;
      }
      proxy.getFilterChains().forEach(chain -> System.out.println(
          "chain for " + ((DefaultSecurityFilterChain) chain).getRequestMatcher() + ": " + chain.getFilters().size() + " filters"));
      System.exit(SpringApplication.exit(context));
    };
  }

  public static void main(String[] args) {
    SpringApplication.run(ChainApp.class, args);
  }
}

//BrokenOrderApp.java
package com.javabrahman.security.brokenorder;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@SpringBootApplication
public class BrokenOrderApp {

  @Bean
  SecurityFilterChain chain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(auth -> auth
        .anyRequest().authenticated()
        .requestMatchers("/public/**").permitAll());   // can never be reached
    return http.build();
  }

  public static void main(String[] args) {
    SpringApplication.run(BrokenOrderApp.class, args);
  }
}