title: intercept-url patterns for REST URLs
body: <p>I am designing a set of REST APIs for accessing the URLs. As per my requirement there are two URLs:</p>
  
  <pre class="lang-none prettyprint-override"><code>http://localhost:3126/securitydemo/webapi/db/students 
  </code></pre>
  
  <p>to view all the students no access required and</p>
  
  <pre class="lang-none prettyprint-override"><code>http://localhost:3126/securitydemo/webapi/db/students/1 
  </code></pre>
  
  <p>only <code>ROLE_USER</code> are allowed.</p>
  
  <p>My Spring Security configuration: </p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;http auto-config="true" use-expressions="true"&gt;
      &lt;intercept-url pattern="**/students/*" access="hasRole('ROLE_USER')" /&gt;
      &lt;http-basic/&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>If I use the pattern <code>**/students/*</code> no basic security popup occurs. If I use <code>/**</code> it's working properly.</p>
  
  <p>How can I intercept the two URLs with different security levels?</p>
  
  <p>My REST service class:</p>
  
  <pre class="lang-java prettyprint-override"><code>@Path("/db")
  @Produces(MediaType.APPLICATION_JSON)
  public class StudentService {
      static StudentDao data = new StudentDaoImpl();
      @Path("/students")
      @GET
      public Response getStudents(){
          GenericEntity&lt;List&lt;Student&gt;&gt; entity = new GenericEntity&lt;List&lt;Student&gt;&gt;(data.getAllStudents()){};
          return  Response.ok(entity).build();
      }
  
      @Path("/students/{id}")
      @GET
      public Response getStudent(@PathParam("id") int id){
          return  Response.ok(data.getStudent(id)).build();
      }
  }
  </code></pre>