How can I tell spring security to apply authorizeRequests just for a specific port?
<p>We configured our new micro service (using Spring-Boot) in a way that the official API is on port 8080 (which is be mapped outside of our virtual network to normal HTTPS on port 443), while some management functions are on a secondary HTTP port 7979. These are only used inside the virtual network, and used for monitoring, loadbalancing etc.</p>

<p>All API access needs to be secured with OAuth, while the management functions should be accessible freely inside the network. So we configured Spring security this way (http is a HttpSecurity object):</p>

<pre><code>    http
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
        .and()
        .authorizeRequests()
            .antMatchers("/info").anonymous()
            .antMatchers("/health").anonymous()

            .antMatchers(HttpMethod.GET, "/warehouses/**").access(oauthScopeRead)
            .antMatchers(HttpMethod.PUT, "/warehouses/**").access(oauthScopeWrite)

            .anyRequest().denyAll();
</code></pre>

<p>This has the effect on both ports: <code>/info</code> and <code>/health</code> are unauthorized, while <code>/warehouses</code> needs authentication, and everything else also needs authentication (returns 401, but when invoking with authentication, it returns 403).</p>

<p>As there is no <code>/info</code> or <code>/health</code> on the public port, these return 404 for unauthorized users, while everything else returns 401. I'm unsatisfied with this and would like to have</p>

<ul>
<li>on the public port, require authentication for everything (and return 404 or 403 only after being authenticated)</li>
<li>on the admin port, require no authentication at all (return 404 for everything which is not one of the configured endpoints).</li>
</ul>

<p>I couldn't find anything about ports in the Spring Security Javadocs or <a href="http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/" rel="noreferrer">reference documentation</a>.</p>

<p>What can I do here?</p>