code: @Override
      protected void configure(HttpSecurity http) throws Exception {
          // Gets a secure random key for the remember be token key
          SecureRandom random = new SecureRandom();
          byte[] randomBytes = new byte[64];
          random.nextBytes(randomBytes);
          String rememberBeKey = new String(Hex.encode(randomBytes));
          // @formatter:off
          http.antMatcher("/**")
              // Only BASIC authentication
              .httpBasic()
                  .authenticationEntryPoint(apiBasicAuthenticationEntryPoint)
                  .realmName("ontrack")
                  .and()
              // Logout set-up
              .logout()
                  .logoutUrl("/user/logout")
                  .logoutSuccessUrl("/user/logged-out")
                  .addLogoutHandler(basicRememberMeUserDetailsService())
                  .and()
              // FIXME CSRF protection for a stateless API?
              //.csrf().requireCsrfProtectionMatcher(new CSRFRequestMatcher()).and()
              .csrf().disable()
              // Allows all at Web level
              .authorizeRequests()
                  .antMatchers("/**").permitAll()
              // Remember be authentication token
              .and().rememberMe()
                  .rememberMeServices(rememberMeServices(rememberBeKey))
                  .key(rememberBeKey)
                  .tokenValiditySeconds(604800)
              // Cache enabled
              .and().headers().cacheControl().disable()
          ;
          // @formatter:on
      }
docs: By default, all queries are accessible anonymously. Security is enforced at service level.