Order of intercept-url patterns in Spring Security

Question

In appSecurity.xml I have this:

intercept-url pattern="/users/profile/**" access="hasRole('VIEW_PROFILES')".

intercept-url pattern="/users/profile/edit/**" access="hasRole('EDIT_PROFILES')"

I have a page /users/profiles/edit/addnew and when user with role VIEW_PROFILES is trying to access this page, he gets it successfully but the access to user with role EDIT_PROFILES is blocked.

What I'm doing wrong?

Answer 1

Since "/users/profile/edit/" is more specific than "/users/profile/", it should be placed higher in the list.

Why

Patterns are always evaluated in the order they are defined. Thus it is important that more specific patterns are defined higher in the list than less specific patterns. This is reflected in our example above, where the more specific /secure/super/ pattern appears higher than the less specific /secure/ pattern. If they were reversed, the /secure/ pattern would always match and the /secure/super/ pattern would never be evaluated.

Source: Core Security Filters