Q:

How to get Jhipster to return different results for authenticated and anonymous users

I have developed a search API using Jhispter that returns search results (e.g., pictures) with  users favourites if they are authenticated. Now I want to return the same results but without users favourites for anonymous users. When I add the route to antMatchers in SecurityConfiguration, the API becomes unsecured. Although I am still sending the token but the security context get a null value. I guess my question is how can allow anonymous users but still have security context when sending a token for personalised results.
public void configure(WebSecurity web) throws Exception {
    web.ignoring()
        .antMatchers(HttpMethod.OPTIONS, "/**")
        .antMatchers("/v2/api-docs")
        .antMatchers("/swagger-ui/index.html")
        .antMatchers("/api/b2c/register")
        .antMatchers("/api/b2c/activate")
        .antMatchers("/api/b2c/reset_password/init")
        .antMatchers("/api/b2c/reset_password/finish")
        .antMatchers("/api/contact-us")
        .antMatchers("/api/search/picture")
}

@Override
public void configure(HttpSecurity http) throws Exception {
    http
        .httpBasic().realmName("server")
        .and()
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and()
            .requestMatchers().antMatchers("/oauth/authorize")
        .and()
            .authorizeRequests()
            .antMatchers("/oauth/authorize").authenticated();
}

A:

The issue was in the order of antmatchers in the OAuth2ServerConfiguration class. 
.antMatchers("/api/**").authenticated() should come after antmatchers with permitAll() access.

