http.cors().and().csrf().disable();       
http.authorizeRequests().antMatchers("/api/**").access("hasIpAddress('Specific ip')"); 
http.formLogin().permitAll();
http.exceptionHandling() .accessDeniedPage("/denied"); 
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);          
http.headers().frameOptions().disable();

It worked well when testing on the web browser. Certain ip allowances were possible, but on the mobile web, when connected via Wi-Fi, it works well, but when connected by data, /api does not work well. How to fix it?