Results 1 to 3 of 3

Thread: Spring security 3 issue with INTERCEPT-URL

  1. #1

    Default Spring security 3 issue with INTERCEPT-URL

    I have been reading the documentation and example but not able to resolve some of the issues with spring security and my project
    I'm using spring security 3 in my project and the following config for intercept-url

    <intercept-url pattern="/secure/user/**"
    access="hasRole('ROLE_USER')"/>
    <intercept-url pattern="/secure/admin/**"
    access="hasRole('ROLE_ADMIN')"/>
    <intercept-url pattern="/secure/**"
    access="isAuthenticated()" />
    <intercept-url pattern="/**"
    access="permitAll" />

    and here is a snap of my jsp code url references
    <a href="secure/admin/adduser.html"..
    <a href="secure/finduser.html" ..

    here are the issues I see with the configuration
    1.once a user login all browser link includes a secure syntax in the link for example in the jsp even though the link is “secure/finduser.html” but the browser link display is secure/secure/finduser.html so once the link is used it goes to xx/secure/secure/finduser.html
    2.once you click on any link the image, style and js links are now secure/image, secure/style and secure/js therefor they can not be found.. for example the reference to style
    <link rel="stylesheet" type="text/css"
    href="../style/style.css" /> but now the style reference link can only be found from xx/secure/style/style.css
    3.if a user click on
    <a href="secure/admin/adduser.html" then all subsequent links will include secure/admin to the link for example the link above will end up in
    xx/secure/admin/secure/admin/adduser.html so therefor not found and returns http status 404 for page not found....

    does any one has any idea why..

    thanks again. -

  2. #2
    Join Date
    Sep 2004
    Location
    Manchester, NH
    Posts
    1,236

    Default

    This is an application issue and not related to Spring Security.

    Are you deploying your web app to the root context of your application server?
    Peter Mularien | Blog
    Author, Spring Security 3 (Book) - Packt Publishing, Available in print and eBook form
    SCJP 5, Oracle DBA
    Any postings are my own opinion, and should not be attributed to my employer or clients.


  3. #3

    Default

    Thank you for your reply and time
    you are absolutely right , this issue has nothing to do with spring security but rather application configuration itself...after using a different path other then the one in spring security configuration still has the same result..
    and yes I do have my web app to the root context of tomcat
    but sill puzzle to why the the first part of any link <a href=”xxxx/someAction.html the xxxx would be included in the subsequent calls , I think I would for sure need to go back to basic and do more search..
    thanks again for your help...

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •