How to apply spring security on specific urls and leave some others using java config? -

i using java config apply spring security , able apply security on particular urls want default login page of spring security whenever hits urls other url not secured. here code of securityconfig:

import javax.sql.datasource;  import org.springframework.beans.factory.annotation.autowired; import org.springframework.context.annotation.configuration; import org.springframework.http.httpmethod; import org.springframework.security.config.annotation.authentication.builders.authenticationmanagerbuilder; //import org.springframework.security.config.annotation.method.configuration.enableglobalmethodsecurity; import org.springframework.security.config.annotation.web.builders.httpsecurity; import org.springframework.security.config.annotation.web.configuration.enablewebsecurity; import org.springframework.security.config.annotation.web.configuration.websecurityconfigureradapter; import org.springframework.web.bind.annotation.requestmethod;  @configuration @enablewebsecurity public class securityconfig extends websecurityconfigureradapter {      @autowired     public void configureglobal(authenticationmanagerbuilder auth) throws exception {         auth             .inmemoryauthentication()                 .withuser("user").password("password").roles("user");     }      @override      protected void configure(httpsecurity http) throws exception {          http             .authorizerequests()                 .antmatchers("/myproject/usercont/user").permitall()                 .anyrequest().authenticated()                 .and()                 .formlogin()                 .loginpage("/myproject/login/form")                 .loginprocessingurl("/login")                 .failureurl("/login/form?error")                 .permitall(); } 

so when hit /myproject/usercont/user method works correctly when hit same url post method or other urls spring security not shows default login page.

can 1 me?

doget , dopost in servlets

you should go through above link clear idea , post methods.

to remove spring security /myproject/usercont/user url ur code should like:

@override      protected void configure(httpsecurity http) throws exception {          http             .authorizerequests()                 .anyrequest().authenticated()                 .and()                 .formlogin()                 .loginpage("/myproject/login/form")                 .loginprocessingurl("/login")                 .failureurl("/login/form?error")                 .permitall(); } 

further more, should not convert urls post method change entire behaviour of web page.

when in xml file

inside configuration element, can restrict access particular urls 1 or more elements. each element specifies url pattern , set of access attributes required access urls. remember must include wildcard @ end of url pattern. failing make url pattern unable match url has request parameters.

 <security:http auto-config="true" >    <security:intercept-url pattern="/index*" access="role_user" />  <security:intercept-url pattern="/transit*" access="role_user" />  <security:form-login login-page="/login.htm" default-target-url="/index.htm"     authentication-failure-url="/loginerror.htm" />    <security:logout logout-success-url="/logout.htm" />  </security:http> 

when ever going describe url without security, should remove particular url above lines of code under security configured xml file. example if dont need security index page above coding should this.

<security:http auto-config="true" >        <security:intercept-url pattern="/transit*" access="role_user" />      <security:form-login login-page="/login.htm" default-target-url="/index.htm"         authentication-failure-url="/loginerror.htm" />        <security:logout logout-success-url="/logout.htm" />      </security:http>