<dependency>
    		<groupId>org.springframework.security</groupId>
    		<artifactId>spring-security-messaging</artifactId>
	</dependency>

@Configuration
public class WebSocketSecurityConfig extends AbstractSecurityWebSocketMessageBrokerConfigurer {

	// Messages with destination: MESSAGE, SUBSCRIBE
	// Messages w/o  destination: CONNECT, DISCONNECT, UNSUBSCRIBE
	// nullDestMatcher() -- CONNECT, DISCONNECT, UNSUBSCRIBE
	
    @Override
    protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
        messages
        
	    // ######## connect #################
            .nullDestMatcher()
	        .authenticated()  // CONNECT, DISCONNECT, UNSUBSCRIBE needs authenticated
        
	    // ######## send #################
            .simpDestMatchers("/channel/**")
	        .hasRole("USER")  // any sessage SENT to "/channel/" will require ROLE_USER
        
	    // ######## receive #################
	    .simpSubscribeDestMatchers("/topic/**", "/queue/*")
                .hasRole("ADMIN") // any message SUBCRIBED for "/topic/ or /queue/" will require ROLE_ADMIN
	    .anyMessage().denyAll();
    }
    
    @Override
    protected boolean sameOriginDisabled() {
        return true;
    }    
}