I have been trying to build a forum using Spring. Some components of the forum require authentication, for which I am using Spring Security. I put these URLs in the requestMatchers().permitAll(). However, when I tried to enter an URL (localhost:8080/post/new/1234) that matches with the pattern, my access is still allowed. The followings are my securityconfiguration:

@Configuration
@EnableWebSecurity(debug = true)
public class SecurityConfig {


    @Autowired
    private JwtAuthenticationFilter jwtAuthenticationFilter;

    @Autowired
    private UserDetailsService customUserDetailsService;


    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(requests -> requests
                .requestMatchers(
                        "/post/new/**",
                        "/post/update/**",
                        "/post/like/**",
                        "/post/report/**",
                        "/thread/new/**",
                        "/thread/like/**",
                        "/thread/report/**").authenticated()
                .anyRequest().permitAll()
            ).sessionManagement(session -> session
                        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                );


        http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }


    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }
}

This is the JwtAuthenticationFilter:

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

@Autowired
private JwtTokenProvider tokenProvider;

@Autowired
private UserDetailsService userDetailsService;

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {
    System.out.println("JwtAuthenticationFilter invoked for URL: " + request.getRequestURI());
    String jwt = getJwtFromRequest(request);
    if (jwt != null && tokenProvider.validateToken(jwt)) {
        System.out.println(jwt);
        String username = tokenProvider.getUserNameFromJWT(jwt);
        UserDetails userDetails = userDetailsService.loadUserByUsername(username);
        UsernamePasswordAuthenticationToken authenciation = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
        authenciation.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
        SecurityContextHolder.getContext().setAuthentication(authenciation);

    }

    filterChain.doFilter(request, response);

} 

private String getJwtFromRequest(HttpServletRequest request) {
    String bearerToken = request.getHeader("Authorization ");
    if (bearerToken != null && bearerToken.startsWith("Bearer ")) {
        return bearerToken.substring(7);
    }
    return null;
}

}

I have tried accessing the URL that matches with the specified patterns in the request matcher but my access is still allowed