title: How to restrict to open all jsp page except login page without authenticate a user?
body: <p>Hi I am new in Spring MVC, when I m trying to design login page using spring security module. Its authenticate correctly and forward into common page. But other hand, if I directly access URl : host /testApp/krams/main/common Its get Open without login. However I tried using “method = RequestMethod.POST” but I get error like "HTTP Status 405 - Request method 'GET' not supported". My all Jsp page under WEB-INF coz I do not want to access directly any page without login. 
  Please help me to understand this concept. Pls look into below code.</p>
  
  <pre><code>@RequestMapping(value = "/login", method = RequestMethod.GET)
  public String getLoginPage(@RequestParam(value="error", required=false) boolean error, 
          ModelMap model) {
      logger.debug("Received request to show login page");
      if (error == true) {
          // Assign an error message
          model.put("error", "You have entered an invalid username or password!");
      } else {
          model.put("error", "");
      }       
      return "loginpage";
  }
  
  
  @RequestMapping(value = "/common", method = RequestMethod.POST)
  public String getCommonPage() {
      logger.debug("Received request to show common page");
  
      System.out.println("---------From  getCommonPage ---------");
  
      // This will resolve to /WEB-INF/jsp/commonpage.jsp
      return "commonpage";
  }
  
  
  &lt;security:http auto-config="true" use-expressions="true" access-denied-page="/krams/auth/denied" &gt;
  
      &lt;security:intercept-url pattern="/krams/auth/login" access="permitAll"/&gt;
      &lt;security:intercept-url pattern="/krams/main/admin" access="hasRole('ROLE_ADMIN')"/&gt;
      &lt;security:intercept-url pattern="/krams/main/common" access="hasRole('ROLE_USER')"/&gt;
      &lt;security:form-login
              login-page="/krams/auth/login" 
              authentication-failure-url="/krams/auth/login?error=true" 
              default-target-url="/krams/main/common"/&gt;           
      &lt;security:logout 
              invalidate-session="true" 
              logout-success-url="/krams/auth/login" 
              logout-url="/krams/auth/logout"/&gt;
  
  &lt;/security:http&gt;
  </code></pre>