title: Spring Security - intercept url pattern for context root
body: <p>I have a simple Spring Security config in root context:</p>
  
  <pre><code>    &lt;security:http auto-config="true"&gt;
      &lt;security:intercept-url pattern="/trac" access="ROLE_ADMIN" /&gt;
  
      &lt;security:form-login login-page="/login" 
             default-target-url="/home"   
             authentication-failure-url="/loginfailed"/&gt;
      &lt;security:logout logout-success-url="/logout" /&gt;
  &lt;/security:http&gt;
  </code></pre>
  
  <p>I would like to secure all requests that come to my app. My Context root is 'trac' so when I run the app from Eclipse it loads: <a href="http://localhost:8080/trac/" rel="nofollow">http://localhost:8080/trac/</a> url.
  I thought this mapping would block any uri with /trac. Hovewer, ony /trac url itself is in fact intercepted and secured. When I paste more detailed url for instance: <a href="http://localhost:8080/trac/cars/add" rel="nofollow">http://localhost:8080/trac/cars/add</a> it's not intercepted and I can simply access any resource and adress. I also tried: </p>
  
  <pre><code>   &lt;security:intercept-url pattern="/trac/**" access="ROLE_ADMIN" /&gt; 
  </code></pre>
  
  <p>with no success. How to fix this config?</p>