diff --git a/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt b/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt
index a3cf02f..b17e72c 100644
--- a/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt
+++ b/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt
@@ -36,7 +36,7 @@ open class WebSecurityConfiguration {
                 .csrf { it.disable() }
                 .authorizeHttpRequests { it.requestMatchers(*PERMITTED_PATHS.toTypedArray<String>()).permitAll() }
                 .authorizeHttpRequests { it.requestMatchers(HttpMethod.OPTIONS).permitAll() }
-                .authorizeHttpRequests { it.anyRequest().permitAll() }
+                .authorizeHttpRequests { it.anyRequest().authenticated() }
                 .oauth2ResourceServer { obj: OAuth2ResourceServerConfigurer<HttpSecurity?> -> obj.jwt(Customizer.withDefaults()) }
         return http.build()
     }