diff --git a/src/main/kotlin/com/android/trisolarisserver/security/SecurityConfig.kt b/src/main/kotlin/com/android/trisolarisserver/security/SecurityConfig.kt
index 3d699e1..42b30b0 100644
--- a/src/main/kotlin/com/android/trisolarisserver/security/SecurityConfig.kt
+++ b/src/main/kotlin/com/android/trisolarisserver/security/SecurityConfig.kt
@@ -2,7 +2,6 @@ package com.android.trisolarisserver.security
 
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
-import org.springframework.core.annotation.Order
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.http.SessionCreationPolicy
@@ -15,24 +14,12 @@ class SecurityConfig(
     private val firebaseAuthFilter: FirebaseAuthFilter
 ) {
     @Bean
-    @Order(0)
-    fun authChain(http: HttpSecurity): SecurityFilterChain {
-        http
-            .securityMatcher("/auth/**", "/", "/health")
-            .csrf { it.disable() }
-            .authorizeHttpRequests { it.anyRequest().permitAll() }
-            .httpBasic { it.disable() }
-            .formLogin { it.disable() }
-        return http.build()
-    }
-
-    @Bean
-    @Order(1)
-    fun apiChain(http: HttpSecurity): SecurityFilterChain {
+    fun filterChain(http: HttpSecurity): SecurityFilterChain {
         http
             .csrf { it.disable() }
             .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
             .authorizeHttpRequests {
+                it.requestMatchers("/", "/health", "/auth/**").permitAll()
                 it.anyRequest().authenticated()
             }
             .httpBasic { it.disable() }