title: Spring Security Access denied 403 after post
body: <p>I've tried almost everything in the others posts about it, nothing is related with my problem.</p>
  
  <p>If I try to recover my URL via GET (ex: path/users/edit/1 ) everything works fine and I get redirected to the user edit page, but If I try to access this page via POST, the spring security deny my access to the page.</p>
  
  <p>Both of the methods are mapped in my controller class.</p>
  
  <pre><code>@RequestMapping(value="/users/edit/{id}", method={RequestMethod.POST,RequestMethod.GET})
  public ModelAndView login(ModelAndView model, @PathVariable("id") int id ) {
      model.addObject("user", this.userService.getUserById(id));
      model.setViewName("/users/add"); //add.jsp
      return model;
  }
  </code></pre>
  
  <p>My form which I use post</p>
  
  <pre><code>&lt;f:form method="post" action="/users/edit/${user.id}"&gt;
       &lt;button type="submit"&gt;Edit&lt;/button&gt;
  &lt;/f:form&gt;
  </code></pre>
  
  <p>Spring security.xml</p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
  http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
  http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
  &lt;!-- enable use-expressions --&gt;
  &lt;http auto-config="true" use-expressions="true"&gt;
      &lt;intercept-url pattern="/secure**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')" /&gt;
      &lt;intercept-url pattern="/secure/users**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')" /&gt;
  
      &lt;!-- access denied page --&gt;
      &lt;access-denied-handler error-page="/denied" /&gt;
      &lt;form-login 
          login-page="/home" 
          default-target-url="/secure" 
          authentication-failure-url="/home?error" 
          username-parameter="inputEmail"
          password-parameter="inputPassword" /&gt;
      &lt;logout logout-success-url="/home?logout"  /&gt;
      &lt;!-- enable csrf protection --&gt;
      &lt;csrf/&gt;
  &lt;/http&gt;
  
  &lt;!-- Select users and user_roles from database --&gt;
  &lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
          &lt;password-encoder hash="md5" /&gt; 
          &lt;jdbc-user-service data-source-ref="dataSource"
              users-by-username-query=
              "SELECT login, senha, ativo
                 FROM usuarios 
                WHERE login = ?"
              authorities-by-username-query=
              "SELECT u.login, r.role
                 FROM usuarios_roles r, usuarios u
                WHERE u.id = r.usuario_id
                  AND u.login = ?" /&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p></p>