Q:

authorizeRequests() order makes a difference?

I am learning Spring and want to know why there is difference when I change order of these two authorizeRequests() methods:
This works fine:
security.authorizeRequests()
    .antMatchers("/css/**")
    .permitAll();

security.authorizeRequests()
    .anyRequest()
    .authenticated();

This does not:
security.authorizeRequests()
    .anyRequest()
    .authenticated();

security.authorizeRequests()
    .antMatchers("/css/**")
    .permitAll();

What I mean by "doesn't work" is that in my login page CSS is not applied while using second example. Why order of these two methods actually matters?

A:

When multiple children to the http.authorizeRequests() method each matcher is considered in the order they were declared. In your second example it define every request require authentication. 

