FF4jSecurityConfig.kt

@Configuration
@EnableWebSecurity
@Order(1)
class FF4jSecurityConfig(private val properties: FF4JProperties): WebSecurityConfigurerAdapter() {

    override fun configure(auth: AuthenticationManagerBuilder) {
        auth.inMemoryAuthentication()
            .withUser(properties.user)
            .password("{noop}${properties.password}")
            .roles(properties.role)
    }

    override fun configure(http: HttpSecurity) {
        http.csrf().disable()
            .authorizeRequests()
            .antMatchers("/ff4j-web-console/**")
            .hasRole("ADMIN")
            .and()
            .httpBasic()
    }
}