@Bean
public SecurityFilterChain filterChain(HttpSecurity http) {
    http
        .csrf().disable()
        .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and()
        .authorizeRequests()
        .antMatchers("/api/auth/**").permitAll()
        .anyRequest().authenticated()
        .and()
        .addFilterBefore(new JwtAuthenticationFilter(jwtTokenProvider), 
                         UsernamePasswordAuthenticationFilter.class);
    
    return http.build();
}