问如何配置GraphQL接口的spring-security？

EN

  GET  /api/v3/         <= REST endpoints only authenticated (k
  POST /api/v4/graphql  <= My new GraphQL endpoint, allow anonymous but only for POST
  POST /api/v4/subscriptions    <= GraphQL subscriptions, allow anonymous
  GET  /playground      <= GraphQL playground web app
  GET  /vendor          <= JS and CSS resources for GraphQL playground 

    @Configuration
    public class OldApiSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
        String basePath = "/api/v3"  // old REST api

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            log.info("Configuring HttpWebSecurity for "+ basePath);
            http
                .authorizeRequests()
                    .antMatchers(basePath+"/_ping").permitAll()   // allow is alive ping
                    .anyRequest().authenticated()                                   // everything else must be authenticated
                .and()
                    .csrf().disable()  
                    .formLogin().disable() 
                    .httpBasic().disable()
                    .logout().disable();

        }
    }

    @Configuration
    @Order(30)   // MUST be smaller than 100 to be first!
    public class GraphQlSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
        String basePath = "/api/v4";   // new GraphQL API


        protected void configure(HttpSecurity http) throws Exception {
            AndRequestMatcher allowedGraphQlRequests = new AndRequestMatcher(
                new RegexRequestMatcher(basePath + "/graphql", HttpMethod.POST.name()),
                new RegexRequestMatcher(basePath + "/subscriptions", HttpMethod.GET.name()),
                new RegexRequestMatcher(basePath + "/playground", HttpMethod.GET.name()),
                new RegexRequestMatcher(basePath + "/vendor", HttpMethod.GET.name())
            );

            http.requestMatcher(allowedGraphQlRequests)  // MUST limit this  to only these URLs !
                .authorizeRequests()
                    .antMatchers(basePath + "/graphql").permitAll()
                    .antMatchers(basePath + "/subscriptions").permitAll()
                    .antMatchers(basePath + "/playground").permitAll()
                    .antMatchers(basePath + "/vendor/**").permitAll().and().csrf().disable();

        }

    }

http.requestMatcher(allowedGraphQlRequests)  // MUST limit this  to only these URLs !
    .authorizeRequests()
        .antMatchers(basePath + LiquidoUrlPaths.GRAPHQL).permitAll().and().csrf().disable()
    .authorizeRequests()
        .antMatchers(basePath + LiquidoUrlPaths.SUBSCRIPTIONS).permitAll()
        .antMatchers(basePath + LiquidoUrlPaths.PLAYGROUND).permitAll()
        .antMatchers(basePath + LiquidoUrlPaths.VENDOR + "/**").permitAll();