title: spring security intercept-url is not working for me
body: <p>In my case I want a particular URL should be accessible only to user with ROLE_ADMIN,but this is not working as even if a user doesnt have ROLE as ROLE_ADMIN,the user is able to see admin specific pages.
  Here is the spring-security .xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:sec="http://www.springframework.org/schema/security"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:aop="http://www.springframework.org/schema/aop"
      xmlns:context="http://www.springframework.org/schema/context"
      xsi:schemaLocation="
          http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd
          http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
          http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee.xsd
          http://www.springframework.org/schema/lang http://www.springframework.org/schema/lang/spring-lang.xsd
          http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
          http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
          http://www.springframework.org/schema/mvc
          http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd
          http://www.springframework.org/schema/beans 
          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
          http://www.springframework.org/schema/security 
          http://www.springframework.org/schema/security/spring-security-3.1.xsd
          "&gt;
  
  
  
      &lt;sec:global-method-security pre-post-annotations="enabled" /&gt;
  
      &lt;sec:http pattern="/css/**" security="none"/&gt;
      &lt;sec:http pattern="/images/**" security="none"/&gt;
      &lt;sec:http pattern="/js/**" security="none"/&gt;
      &lt;sec:http pattern="/index.jsp" security="none"/&gt;
      &lt;!-- &lt;sec:http pattern="/app/addNewUser.json" security="none"/&gt; --&gt;
      &lt;sec:http pattern="/login.jsp" security="none"/&gt;
      &lt;sec:http use-expressions="true"&gt;
          &lt;!--
               Allow all other requests. In a real application you should
               adopt a whitelisting approach where access is not allowed by default
            --&gt;
          &lt;sec:intercept-url pattern="/**" access="isAuthenticated()" /&gt;
          &lt;sec:form-login login-page='/login.jsp'
            authentication-failure-url="/login.jsp?login_error=1"
            default-target-url="/index.jsp" /&gt;
          &lt;sec:logout logout-success-url="/login.jsp" delete-cookies="JSESSIONID"/&gt;
          &lt;sec:remember-me /&gt;
   &lt;sec:intercept-url pattern="/**/referencemetadatahome*" access="hasRole('ROLE_ADMIN')" /&gt;
      &lt;/sec:http&gt;
  
      &lt;bean id="myUserService" class="com.aa.ceg.proj.mars.serviceimpl.UserServiceImpl" /&gt;
      &lt;sec:authentication-manager&gt;
      &lt;sec:authentication-provider user-service-ref="myUserService" /&gt;
      &lt;/sec:authentication-manager&gt;
  &lt;bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>Here is web.xml;</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5"&gt;
    &lt;display-name&gt;Spring3MVC&lt;/display-name&gt;
    &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
              /WEB-INF/spring-rootcontext.xml
              /WEB-INF/spring-security.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
         &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
        &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt; 
  
      &lt;!--
        - Loads the root application context of this web app at startup.
      --&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
  
    &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;index.jsp&lt;/welcome-file&gt;
    &lt;/welcome-file-list&gt;
  
    &lt;servlet&gt;
      &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
      &lt;servlet-class&gt;
              org.springframework.web.servlet.DispatcherServlet
          &lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
    &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/app/*&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
   &lt;filter&gt;
         &lt;filter-name&gt;CAS Single Sign Out Filter&lt;/filter-name&gt;
         &lt;filter-class&gt;org.jasig.cas.client.session.SingleSignOutFilter&lt;/filter-class&gt;
      &lt;/filter&gt;
   &lt;filter-mapping&gt;
         &lt;filter-name&gt;CAS Single Sign Out Filter&lt;/filter-name&gt;
         &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.jasig.cas.client.session.SingleSignOutHttpSessionListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p>I am able to access <code>/app/referencemetadatahome.html</code> even if user doesnot have role as ROLE_ADMIN. What could be the problem?</p>