Create a controller class named UserController.kt, as follows:

@RestController
@RequestMapping("/")
class UserController{

//    This is for all means there is no security issue for this URL path
    @GetMapping(value = ["/open_for_all", ""])
    fun home(): String{
        return "This area can be accessed by all."
    }

    //    Yu have to use token to get this URL path
    @GetMapping("/private")
    fun securedArea(): String{
        return "You used an access token to enter this area."
    }
}

Here, we've annotated this class as @RestController, which handles all the web requests. @RequestMapping("/") means that the default URL path is "/".

The @GetMapping implemented functions are home(), which can be accessed by everyone, and securedArea(), which can be accessed only by those who have the access token. We configured these in the ResourceServerConfig class.