Question

What is the real use of the security:http element in the spring security configurations. Is it applicable only for the web applications?

Please see the following code:

<security:http use-expressions="true">
        <security:intercept-url pattern="/client/**"
            access="isAuthenticated()" />
        <security:intercept-url pattern="/**" access="permitAll" />
        <security:form-login></security:form-login>
        <security:logout />
        <security:remember-me />

        <security:session-management
            invalid-session-url="/timeout.jsp">
            <security:concurrency-control
                max-sessions="1" error-if-maximum-exceeded="true" />
        </security:session-management>

    </security:http>

Explain it if you can.

Answer 1

The <http> element is only applicable to web applicaitons. You should probably start with the namespace chapter of the manual.

There is also an appendix, which lists each element/attribute and their function.