package io.github.jordao76.quotes.web;

import static org.springframework.http.HttpMethod.*;

import org.springframework.context.annotation.*;
import org.springframework.security.config.annotation.authentication.builders.*;
import org.springframework.security.config.annotation.web.builders.*;
import org.springframework.security.config.annotation.web.configuration.*;

@Configuration
@EnableWebSecurity
public class QuoteSecurity extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      .csrf().disable()
      .headers().frameOptions().disable()
      .and().httpBasic()
      .and().authorizeRequests()
        .antMatchers(GET, "/quotes/**").permitAll()
        .antMatchers(DELETE, "/quotes/**").hasRole("MAINTAINER")
        .antMatchers(POST, "/quotes").hasRole("MAINTAINER")
        .antMatchers("/manage/**", "/h2-console/**").hasRole("ADMIN")
        .antMatchers("/**").denyAll();
  }

  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth
      .inMemoryAuthentication()
      .withUser("admin")
      .password("password")
      .roles("MAINTAINER", "ADMIN");
  }

}

package io.github.jordao76.quotes.web;

import static org.springframework.http.HttpMethod.*;

import org.springframework.context.annotation.*;
import org.springframework.security.config.annotation.authentication.builders.*;
import org.springframework.security.config.annotation.web.builders.*;
import org.springframework.security.config.annotation.web.configuration.*;

@Configuration
@EnableWebSecurity
public class QuoteSecurity extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      .csrf().disable()
      .authorizeRequests()
        .antMatchers(GET, "/quotes/**").permitAll()
        .antMatchers(DELETE, "/quotes/**").hasRole("MAINTAINER")
        .antMatchers(POST, "/quotes").hasRole("MAINTAINER")
        .antMatchers("/manage/**").hasRole("ADMIN")
        .antMatchers("/**").denyAll()
      .and()
        .httpBasic();
  }

  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth
      .inMemoryAuthentication()
      .withUser("admin")
      .password("password")
      .roles("MAINTAINER", "ADMIN");
  }

}

--- 
+++ 
@@ -15,14 +15,14 @@
   protected void configure(HttpSecurity http) throws Exception {
     http
       .csrf().disable()
-      .authorizeRequests()
+      .headers().frameOptions().disable()
+      .and().httpBasic()
+      .and().authorizeRequests()
         .antMatchers(GET, "/quotes/**").permitAll()
         .antMatchers(DELETE, "/quotes/**").hasRole("MAINTAINER")
         .antMatchers(POST, "/quotes").hasRole("MAINTAINER")
-        .antMatchers("/manage/**").hasRole("ADMIN")
-        .antMatchers("/**").denyAll()
-      .and()
-        .httpBasic();
+        .antMatchers("/manage/**", "/h2-console/**").hasRole("ADMIN")
+        .antMatchers("/**").denyAll();
   }
 
   @Override
Add /h2-console to security ADMIN role

- /h2-console was inadvertently shut out when security was added
