Just a note as I ran into a problem with this last year:
In case you want to use Spring Security with HTTP method in intercept-url like the following
Code:
<!-- HTTP security configurations -->
<http auto-config="true" use-expressions="true">
<form-login login-processing-url="/static/j_spring_security_check" login-page="/login" authentication-failure-url="/login?login_error=t"/>
<logout logout-url="/static/j_spring_security_logout"/>
<!-- Configure these elements to secure URIs in your application -->
<intercept-url pattern="/**" method="DELETE" access="hasRole('ROLE_SYSADMIN')"/>
<intercept-url pattern="/admin/**/form" access="hasRole('ROLE_ADMIN_EDITOR') or hasRole('ROLE_SYSADMIN')"/>
<intercept-url pattern="/order/**" access="hasRole('ROLE_ORDER_VIEWER') or hasRole('ROLE_ORDER_EDITOR') or hasRole('ROLE_SYSADMIN')" />
<intercept-url pattern="/resources/**" access="permitAll" />
<intercept-url pattern="/static/**" access="permitAll" />
<intercept-url pattern="/**" access="permitAll" />
<session-management session-fixation-protection="newSession"/>
</http>
you have to switch the order of the last two filter mappings:
Code:
<filter-mapping>
<filter-name>CharacterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>Spring OpenEntityManagerInViewFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>HttpMethodFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
The reason is that HTML forms do always send data via POST or GET. As a workaround Spring MVC uses a hidden formfield supplying the intended HTTP method which is parsed by HttpMethodFilter.
Happy Hacking!
Cheers
Alex