title: Spring Security anonymous user has acces to every url
body: <p>I'm developing gwt application which I want to secure using spring-security. I have users data in database and UserService is responsible for getting particular User. I have followed this  <a href="http://www.javacodegeeks.com/2010/12/securing-gwt-apps-with-spring-security.html" rel="nofollow">tutorial</a></p>
  
  <p>AuthenticationProvider:</p>
  
  <pre><code>public class CustomAuthenticationProvider implements AuthenticationProvider {
  
      @Autowired UserService userService;
  
      @Override
      public Authentication authenticate(Authentication authentication) throws AuthenticationException {
          String username = (String) authentication.getPrincipal();
          String password = (String) authentication.getCredentials();
  
          User user = userService.findByUserName(username);
          if (user == null) {
              throw new UsernameNotFoundException("User not found");
          }
          String storedPass = user.getPassword();
          if (!storedPass.equals(password)) {
              throw new BadCredentialsException("Invalid password");
          }
          Authentication customAuthentication = new CustomUserAuthentication(user, authentication);
          customAuthentication.setAuthenticated(true);
  
          return customAuthentication;
      }
  
     @Override
     public boolean supports(Class&lt;?&gt; authentication) {
        return     UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
     }
  }
  </code></pre>
  
  <p>CustomAuthentication</p>
  
  <pre><code>    public class CustomUserAuthentication implements Authentication {
  
          private static final long serialVersionUID = -3091441742758356129L;
  
          private boolean authenticated;
  
          private final GrantedAuthority grantedAuthority;
          private final Authentication authentication;
          private final User user;
  
          public CustomUserAuthentication(User user, Authentication authentication) {
              this.grantedAuthority = new SimpleGrantedAuthority(user.getRole().name());
              this.authentication = authentication;
              this.user = user;
          }
  
          @Override
          public Collection&lt;GrantedAuthority&gt; getAuthorities() {
              Collection&lt;GrantedAuthority&gt; authorities = new ArrayList&lt;GrantedAuthority&gt;();
              authorities.add(grantedAuthority);
              return authorities;
          }
  
          @Override
          public Object getCredentials() {
              return authentication.getCredentials();
          }
  
          @Override
          public Object getDetails() {
              return authentication.getDetails();
          }
  
          @Override
          public Object getPrincipal() {
              return user;
          }
  
          @Override
          public boolean isAuthenticated() {
              return authenticated;
          }
  
          @Override
          public void setAuthenticated(boolean authenticated) throws IllegalArgumentException {
              this.authenticated = authenticated;
          }
  
          @Override
          public String getName() {
              return user.getUsername();
          }
  
      }  
  </code></pre>
  
  <p>security context:</p>
  
  <pre><code>&lt;s:http auto-config="true" create-session="always" &gt;
      &lt;s:intercept-url pattern="/index.html" access="ROLE_USER" /&gt;
      &lt;s:logout logout-success-url="/login.html"/&gt;
      &lt;s:form-login login-page="/login.html" default-target-url="/index.html" authentication-failure-url="/login.html" /&gt;
  &lt;/s:http&gt;
  
  &lt;s:authentication-manager alias="authenticationManager"&gt;
      &lt;s:authentication-provider ref="customAuthenticationProvider" /&gt;
  &lt;/s:authentication-manager&gt;
  
  &lt;bean id="customAuthenticationProvider" class="com.example.server.security.CustomAuthenticationProvider" /&gt;
  </code></pre>
  
  <p>Everything works fine, spring intercept call to index.html i need to log and it redirects me back to index.html. The problem is when i log out and then go to index.html once again I just simply get access to it. I figured out that: </p>
  
  <pre><code>    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
      System.out.println("Logged as: " + auth.getName()); 
  </code></pre>
  
  <p>prints anonymousUser after logout. This code prints my user name when I log in again so I suppose that there is something wrong with intercepting anonymous user. Does anyone knows how to intercept anonymous user?</p>