title: Spring Security multiple filterChainProxy mapping/filters, custom filters Json Output
body: <p>I have a part of my web application that is an RESTfull api and part a more standard web-pages.</p>
  
  <p>I wish to have the REST part with some custom filters such as the EntryPoint, SuccessHandler and FailureHandler. This part is within the /rest/** mapping.</p>
  
  <p>In the other hand, everything else needs to have more common filters and is mapped with /**.</p>
  
  <p>The problem is to find an easy way to define the filterChainProxy with different mapping-filters.</p>
  
  <p>Right now this solution doesn't work:</p>
  
  <pre><code>    &lt;!-- Normal web app --&gt;
  &lt;http auto-config="true" use-expressions="true" authentication-manager-ref="authenticationManager"&gt;
      &lt;form-login/&gt;
      &lt;logout/&gt;
      &lt;intercept-url pattern="/**" access="hasRole('ROLE_USER')" /&gt;
  &lt;/http&gt;
  
  &lt;!-- Configure RESTfull services --&gt;
  &lt;http use-expressions="true" authentication-manager-ref="authenticationManager" entry-point-ref="restAuthenticationEntryPoint" &gt;
      &lt;form-login authentication-success-handler-ref="restAuthenticationSuccessHandler" login-page="/rest/login" username-parameter="username" password-parameter="password" /&gt;
      &lt;logout logout-url="/rest/logout" /&gt;
      &lt;intercept-url pattern="/rest/**" method="GET" access="hasRole('ROLE_USER')" /&gt;
      &lt;intercept-url pattern="/rest/**" method="POST" access="hasRole('ROLE_ADMIN')" /&gt;
      &lt;intercept-url pattern="/rest/**" method="PUT" access="hasRole('ROLE_ADMIN')" /&gt;
      &lt;intercept-url pattern="/rest/**" method="DELETE" access="hasRole('ROLE_ADMIN')" /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>It complains with: the univseral match being before other patterns.</p>
  
  <p><strong>Is there a way to define such a thing without resorting to define the filterChainProxy with the  definition?</strong> The http version does help quite a lot to reduce the amount of configuration as I will have to manually set a UsernamePasswordAuthenticationFilter etc.</p>
  
  <p>The next problem is more simple: I have to respond, after the form-login authentication with a JSON object.</p>
  
  <p>So far, I have implemented a SuccessHandler (actually a version of the SimpleUrlAuthenticationSuccessHandler without the redirect part).</p>
  
  <p>How do I write my JSON output?</p>
  
  <p>I must have something like this:</p>
  
  <pre><code>HTTP 200 OK
  </code></pre>
  
  <p>with:</p>
  
  <pre><code>{"success":true,"customer {"email":"customer@email.com","session_id":"b83a41dfaca6785399f00837888886e646ff9088"}}
  </code></pre>
  
  <p>and a similar thing with the FailureHandler. It must be quite simple and it's surely is some very basic thing, but how do you do that? Redirecting to a custom controller is not a solution since I will have the 301 redirect status that a very simple REST client might not be able to understand.</p>
  
  <p>At the very least, I wish to have only the http header and no body at all.</p>
  
  <p>thanks!</p>