title: Spring Security Context is null when accessing Tomcat application without trailing slash
body: <p>I have a Spring based web application deployed on Tomcat 7. What I do to run it is copy the <code>application.war</code> archive into the webapps directory and start the server, so my application root is available under <code>https://localhost:8443/application/</code>.</p>
  
  <p>Then I wanted to add Spring security (3.2.4) to it. My intention is to secure the entire application, not only parts of it. The Spring security configuration I have:</p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
               xmlns:beans="http://www.springframework.org/schema/beans"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:schemaLocation="http://www.springframework.org/schema/beans
                                  http://www.springframework.org/schema/beans/spring-beans.xsd
                                  http://www.springframework.org/schema/security
                                  http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
      &lt;http auto-config="true"&gt;
          &lt;intercept-url pattern="/**" access="ROLE_USER" /&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="admin" password="admin" authorities="ROLE_USER" /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>And in <code>web.xml</code>:</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;
           org.springframework.web.filter.DelegatingFilterProxy
      &lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>It's a basic configuration which can be found in the official docs and many tutorials. Everything works fine, when I'm not authenticated Spring redirects me to it's default login page. I can then log in and can access the application until the session expires or I navigate to the logout url.</p>
  
  <p>The problem begins to show up when I access the application root without the trailing slash: <code>https://localhost:8443/application</code>.</p>
  
  <p>Spring fails to find the security context:</p>
  
  <pre><code>2016-07-19 17:48:36,650 DEBUG: security.web.FilterChainProxy - / at position 1 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  2016-07-19 17:48:36,650 DEBUG: web.context.HttpSessionSecurityContextRepository - HttpSession returned null object for SPRING_SECURITY_CONTEXT
  2016-07-19 17:48:36,650 DEBUG: web.context.HttpSessionSecurityContextRepository - No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@53b1e801. A new one will be created.
  </code></pre>
  
  <p>I then get redirected to the login page, but after I log in I get redirected to the original URL without the slash, Spring fails again and I see the login form again.</p>
  
  <p>Does anybody know why is this happening? My configuration is minimal, uses out of the box defaults. The use case is also very simple and it feels weird that this is not working as expected. I feel I'm missing something fundamental, either with Spring or Tomcat.</p>
  
  <p>Any help will be appreciated, thanks.</p>