SecurityConfiguration.java

    protected void configure(HttpSecurity http) throws Exception {
        // disabling csrf since this is REST
        http.csrf().disable();

        // handle unauthorized access
        http.exceptionHandling().authenticationEntryPoint(new UnauthorizedHandler());

        // no need to have a user session
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        // disable form login
        http.httpBasic().disable();
        http.formLogin().disable();
        http.logout().disable();

        // permit access to token endpoint
        http.authorizeRequests().antMatchers("/token").permitAll();
        // secure all requests
        http.authorizeRequests().anyRequest().authenticated();

        http.cors();

        // custom token based authentication
        http.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
    }