http.authorizeRequests() .antMatchers("/swagger*/**").authenticated() .anyRequest().permitAll() .and() .csrf().disable();