Spring Security <http> and <intercept-url> pattern attributes

Question

I have seen Spring Security OAuth2 samples has this defined in the spring-servlet.xml,

   <http pattern="/users/**" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
      access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security">
    <anonymous enabled="false" />
    <intercept-url pattern="/photos" access="ROLE_USER,SCOPE_READ" />
    <intercept-url pattern="/photos/trusted/**" access="ROLE_CLIENT,SCOPE_TRUST" />
    <intercept-url pattern="/photos/user/**" access="ROLE_USER,SCOPE_TRUST" />
    <intercept-url pattern="/photos/**" access="ROLE_USER,SCOPE_READ" />
    <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>

Is the pattern attribute in http tag valid? I could not find its definition in the spring-security-2.0.1.xsd. If it is valid, what is the relationship of this pattern with intercept-url's pattern attribute? Take for example, does the intercept path /photos/user/** has the final matching interception path of /users/photos/user/**? Thanks.

Answer 1

The pattern attribute was introduced in 3.1 which introduced namespace support for multiple filter chains. Spring Security 2 is very out of date (you shouldn't be using it).

The patterns in the intercept-url elements are independent, in that they are matched against the incoming request URI in the same way as the filter chain http pattern is checked. However if the latter doesn't match, the filter chain won't be applied to the request at all, so in order to have any effect, they must be consistent with the filter chain pattern.

For the example you've posted, this would mean that none of the /photos patterns have any effect. They should all have the prefix that the main filter chain matches - i.e. they should begin with /users/photos.

Answer 2

In the case of spring security 4, Role is checked by haseRole('ADMIN'), Just try it.

It works fine for me.