I am wondering that am I able to use two different jwt token value for different paths.

My code block is:

 @Order(1)
    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf(AbstractHttpConfigurer::disable)
                .formLogin(AbstractHttpConfigurer::disable)
                .oauth2ResourceServer((oauth2) -> oauth2
                        .jwt((jwt) -> jwt.jwtAuthenticationConverter(jwtAuthenticationConverter).decoder(chatbotJwtDecoder()))
                        .authenticationEntryPoint(delegatedAuthenticationEntryPoint)
                        .accessDeniedHandler(delegatedAccessDeniedHandler))
                .authorizeHttpRequests(request -> {
                    request.requestMatchers("/quick-questions").permitAll();
                    request.anyRequest().authenticated();
                })
                .sessionManagement(sessionManagementConfigurer -> sessionManagementConfigurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        return http.build();
    }

    @Order(2)
    @Bean
    SecurityFilterChain memberFilterChain(HttpSecurity http) throws Exception {
        http.csrf(AbstractHttpConfigurer::disable)
                .formLogin(AbstractHttpConfigurer::disable)
                .oauth2ResourceServer((oauth2) -> oauth2
                        .jwt((jwt) -> jwt.jwtAuthenticationConverter(jwtAuthenticationConverter).decoder(memberJwtDecoder()))
                        .authenticationEntryPoint(delegatedAuthenticationEntryPoint)
                        .accessDeniedHandler(delegatedAccessDeniedHandler))
                .authorizeHttpRequests(request -> {
                    request.requestMatchers("/quick-questions").authenticated();
                    //request.anyRequest().permitAll();
                })
                .sessionManagement(sessionManagementConfigurer -> sessionManagementConfigurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        return http.build();
    }

    @Primary
    @Bean
    public JwtDecoder chatbotJwtDecoder() {
        return NimbusJwtDecoder.withPublicKey(publicKey()).build();
    }

    @Bean
    public JwtDecoder memberJwtDecoder() {
        RSAPublicKey rsaPublicKey;
        try {
            rsaPublicKey = readPublicKey(publicKeyResource.getInputStream());
        } catch (Exception e) {
            throw new RuntimeException(e);
        }

        return NimbusJwtDecoder.withPublicKey(rsaPublicKey).build();
    }

so I am making request for path “/quick-questions” and I permit for this path for filterChain which Order(1).

in the second SecurityFilterChain which belongs memberFilterChain,

request.requestMatchers(“/quick-questions”).authenticated();

I expect to give me error but I can pass through this endpoint with chatbotJwtDecoder’s jwt value.

So what could it be wrong, any ideas?