title: Spring Security: How to authorize user for a given URL when using multiple `http` elements?
body: <p>I have a spring MVC web application built in a modular fashion. Each module that is added to the website may define its own security elements (using <code>http</code> namespace in xml) for user authorization, this is fine and working. </p>
  
  <p>I now need to programmatically check if the current user has access to a given URL. I have searched and searched and found many references to the <code>WebInvocationPrivilegeEvaluator</code>, which would be great, except my application currently has 6 of these and I am not sure which one to use (it has 6 <code>&lt;http:</code> elements). I have tried looping all 6 and performing the check on each one, but this returns strange results. </p>
  
  <p>Example:</p>
  
  <p>I can get all of the beans using the following:</p>
  
  <pre><code>private Collection&lt;WebInvocationPrivilegeEvaluator&gt; privEvals;
  ....
  privEvals = (List&lt;WebInvocationPrivilegeEvaluator&gt;) applicationContext.getBeansOfType(WebInvocationPrivilegeEvaluator.class).values();
  </code></pre>
  
  <p>And loop check like this:</p>
  
  <pre><code>public void checkForUrl(String url) {
      for(WebInvocationPrivilegeEvaluator privEval:privEvals) {
          System.out.println(privEval.isAllowed(url, SecurityContextHolder.getContext().getAuthentication()));
      }
  }
  </code></pre>
  
  <p>Example 1: The user is authorized for the URL, prints: <br>
  false <br>
  false <br>
  true<br>
  true<br>
  true<br>
  true<br></p>
  
  <p>Example 2: The same user is not authorized for the URL, prints:<br>
  false <br>
  false<br>
  true<br>
  true<br>
  true<br>
  true<br></p>
  
  <p>But if I try to browse to the URLs I get the correct <code>403</code> for the second url.</p>
  
  <p><strong>Update</strong></p>
  
  <p>If I use the other method of <code>WebInvocationPrivilegeEvaluator</code> which accepts context, I get the same result. I have tried many URLs with different <code>http</code> elements securing them, and the same boolean values are returned (in the same order).</p>
  
  <p>If I use a different <strong>user</strong> with different roles assigned, I get the same problem where the results are always the same for different URLs (when the user is or isn't authorized to access them), except this time the following is printed:<br>
  false<br>
  true<br>
  true<br>
  true<br>
  false<br>
  true<br></p>
  
  <p><strong>Update</strong> </p>
  
  <p>I have tried using the <code>&lt;sec:authorize</code> tag with more strange results, it appears as though it is just using the first <code>WebInvocationPrivilegeEvaluator</code>.</p>