Spring安全过滤器链请求匹配器工作不正常

enter code here http
            .csrf(AbstractHttpConfigurer::disable)
            .cors(customizer -> customizer
                    .configurationSource(request -> {
                        CorsConfiguration config = new CorsConfiguration();
                        config.setAllowedOrigins(Collections.singletonList("http://localhost:3000"));
                        config.setAllowedMethods(Collections.singletonList("*"));
                        config.setAllowedHeaders(Collections.singletonList("*"));
                        config.setAllowCredentials(true);
                        config.setMaxAge(3600L);
                        return config;
                    }))
            .authorizeHttpRequests(customizer -> customizer
                    .requestMatchers("/api/v1/auth/**").permitAll()
                    .requestMatchers("/api/v1/auth/validate-session").authenticated()
                    .requestMatchers("/api/v1/demo").authenticated()
                    .anyRequest().authenticated()
            )
            .sessionManagement(customizer -> customizer
                    .invalidSessionUrl("/api/v1/auth/logout?expired")
                    .maximumSessions(1)
                    .maxSessionsPreventsLogin(false)
            )
            .httpBasic(Customizer.withDefaults())
            .logout(customizer -> customizer
                    .logoutUrl(LOGOUT_URL)
                    .logoutSuccessUrl(LOGOUT_SUCCESS_URL)
                    .invalidateHttpSession(true)
                    .deleteCookies("JSESSIONID")
            );
    return http.build();

我无法保护/api/v1/auth/validate会话,因为我允许/api/v1/auth/**。我想在允许其他请求的同时,使安全的验证会话端点成为可能。是否有任何方法可以覆盖该模式。