title: Spring Security not restricting access
body: <p>I am new to Spring Security and have run into a problem. When I attempt to access a page that is expected to be restricted it is displaying the requested page anyway, no 403 nor redirecting to login page, no errors in the logs, nothing, just as if Spring Security was not implemented at all.</p>
  
  <p>When the application is deployed I see the following in the logs which tells me Spring Security is at least starting:</p>
  
  <pre><code>INFO: Checking whether login URL '/security/credentials' is accessible with your configuration
  </code></pre>
  
  <p>I have attempted to change the login page to a restricted page, just to test that is actually restricted and I get the following, which tells me that it is correctly being restricted, at least in the simulation.</p>
  
  <pre><code>INFO: Checking whether login URL '/dashboard' is accessible with your configuration
  
  org.springframework.security.config.http.DefaultFilterChainValidator checkLoginPageIsntProtected
  WARNING: Anonymous access to the login page doesn't appear to be enabled. This is almost certainly an error. Please check your configuration allows unauthenticated access to the configured login page. (Simulated access was rejected: org.springframework.security.access.AccessDeniedException: Access is denied)
  </code></pre>
  
  <p>I have the following setup:</p>
  
  <p>web.xml
      </p>
  
  <pre><code>&lt;web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee 
           http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"&gt;
  
     &lt;welcome-file-list&gt;
        &lt;welcome-file&gt;
           index.html
        &lt;/welcome-file&gt;
     &lt;/welcome-file-list&gt;
  
     &lt;context-param&gt;
        &lt;param-name&gt;javax.servlet.jsp.jstl.fmt.localizationContext&lt;/param-name&gt;
        &lt;param-value&gt;messages&lt;/param-value&gt;
     &lt;/context-param&gt;
  
     &lt;context-param&gt;
        &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
        &lt;param-value&gt;
          WEB-INF/applicationContext.xml
      &lt;/param-value&gt;
     &lt;/context-param&gt;
  
     &lt;listener&gt;
        &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
     &lt;/listener&gt;
  
     &lt;filter&gt;
        &lt;filter-name&gt;UrlRewriteFilter&lt;/filter-name&gt;
        &lt;filter-class&gt;org.tuckey.web.filters.urlrewrite.UrlRewriteFilter&lt;/filter-class&gt;
        &lt;init-param&gt;
           &lt;param-name&gt;logLevel&lt;/param-name&gt;
           &lt;param-value&gt;TRACE&lt;/param-value&gt;
        &lt;/init-param&gt;
     &lt;/filter&gt;
     &lt;filter-mapping&gt;
        &lt;filter-name&gt;UrlRewriteFilter&lt;/filter-name&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
        &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;
     &lt;/filter-mapping&gt;
  
  
     &lt;filter&gt;
        &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
        &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
     &lt;/filter&gt;
     &lt;filter-mapping&gt;
        &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
     &lt;/filter-mapping&gt;
  
     &lt;servlet&gt;
        &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
        &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
        &lt;init-param&gt;
           &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
           &lt;param-value&gt;
              /WEB-INF/applicationContext.xml
          &lt;/param-value&gt;
        &lt;/init-param&gt;
        &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  
     &lt;/servlet&gt;
     &lt;servlet-mapping&gt;
        &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
        &lt;url-pattern&gt;/app/*&lt;/url-pattern&gt;
     &lt;/servlet-mapping&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>The Spring Security configuration file is imported from my applicationContext.xml. </p>
  
  <p>spring-security.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
     xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="
        http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
     &lt;http auto-config="true" use-expressions="true"&gt;
        &lt;form-login 
           login-page="/security/credentials"
           login-processing-url="/security/signin" 
           default-target-url="/dashboard"
           authentication-failure-url="/security/signin_failed" /&gt;
        &lt;intercept-url pattern="/resources/**" access="permitAll"/&gt;
        &lt;intercept-url pattern="/security/**" access="permitAll" /&gt;
        &lt;intercept-url pattern="/favicon.ico" access="permitAll"/&gt;
        &lt;intercept-url pattern="/**" access="denyAll"/&gt;
        &lt;logout logout-success-url="/security/signout" /&gt;
        &lt;remember-me /&gt;
     &lt;/http&gt;
  
     &lt;authentication-manager alias="authenticationManager"&gt;
        &lt;authentication-provider&gt;
           &lt;user-service&gt;
              &lt;user name="test" password="password" authorities="ROLE_USER" /&gt;
           &lt;/user-service&gt;
        &lt;/authentication-provider&gt;
     &lt;/authentication-manager&gt;
  &lt;/beans:beans&gt;
  </code></pre>