anchor.diff:  
   So, finally, change your authorization rules to filter all dispatcher types.
   
  -To do this, change:
  +To do this, you should change:
   
   ====
   .Java
  
positive.code:     <!-- ... -->
      <intercept-url pattern="/**" access="denyAll"/>
  </http>
  ----
  ====
  
  
negative.code: ----
  ====
  
  [[switch-filter-all-dispatcher-types]]
  ==== Switch to filter all dispatcher types
  
  Spring Security 5.8 and earlier only xref:servlet/authorization/architecture.adoc[perform authorization] once per request.
  