################# EnPara versiones de Spring-Boot anteriores a 2.7
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
    @Value( "${server.scopes}" )
    private String[] serverScopes;
 
    @Value( "${app.server.path}" )
    private String apiPath;
 
    @Bean
    public FundeWebJSLoggingAuthorizationFilter loggingFilterBean() {
       return new FundeWebJSLoggingAuthorizationFilter();
    }
 
    @Override
    protected void configure( HttpSecurity http ) throws Exception {
        http.requestMatchers().antMatchers( "/public/**" ).and().requestMatchers().antMatchers( apiPath + "/**" ).and()
        .sessionManagement().sessionCreationPolicy( SessionCreationPolicy.STATELESS )
        // configuro politica de sesion sin estado
        .and().cors() // Aniado configuracion CORS por defecto
                .and().csrf().disable().authorizeRequests().mvcMatchers( apiPath + "/public/**" ).permitAll()
        .mvcMatchers( apiPath + "/**" ).hasAnyAuthority( serverScopes ).anyRequest().authenticated().and()
        .addFilterAfter( loggingFilterBean(), BearerTokenAuthenticationFilter.class )
        .oauth2ResourceServer().jwt();
    }
}

############### O bien:

############### En versiones de Spring-Boot 2.7.X
public class SecurityConfig {
 
    @Value( "${server.scopes}" )
    private String[] serverScopes;
 
    @Value( "${app.server.path}" )
    private String apiPath;
 
    @Bean
    public FundeWebJSLoggingAuthorizationFilter loggingFilterBean() {
       return new FundeWebJSLoggingAuthorizationFilter();
    }
 
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.requestMatchers().antMatchers( "/public/**" ).and().requestMatchers().antMatchers( apiPath + "/**" ).and()
        .sessionManagement().sessionCreationPolicy( SessionCreationPolicy.STATELESS )
        // configuro politica de sesion sin estado
        .and().cors() // Aniado configuracion CORS por defecto
                .and().csrf().disable().authorizeRequests().mvcMatchers( apiPath + "/public/**" ).permitAll()
        .mvcMatchers( apiPath + "/**" ).hasAnyAuthority( serverScopes ).anyRequest().authenticated().and()
        .addFilterAfter( loggingFilterBean(), BearerTokenAuthenticationFilter.class )
        .oauth2ResourceServer().jwt();
 
        return http.build();
    }
}