Question

I am using the spring security for the authentication of my web application. I could successfully use it by configuring as follows:

<http auto-config='true'>
    <intercept-url pattern="/Login" filters="none" access="ROLE_USER"/>
    <form-login login-page='/Login' authentication-failure-url="/Login/Failure" 
        default-target-url="/Url"/>
</http>

<authentication-manager>
    <authentication-provider>
        <user-service>
           <user name="admin" password="admin" authorities="ROLE_USER" />
        </user-service>
    </authentication-provider>
</authentication-manager>

The above code working fine for if I directly login from the login page. If one of the user is accessing the different url which is not the login page. Now I want to restrict the user to access any direct url without login to the system first time.

How can i do that?

Answer 1

You need to change the intercept rule to:

<intercept-url pattern="/**" filters="none" access="ROLE_USER"/>

You might also have to exlude the login page from the auth requirement. Because a user does not have to login in order to see the login page. You can do that by adding:

<intercept-url pattern="/Login" filters="none"/>