title: How I can block all pages except loginpage?
body: <p>I want to block all pages except the login and error page with Spring Security, but if I do <code>pattern="/*"</code> it will lock absolutely all pages and result in an endless redirect. How I can lock all pages except login and error page for authorization?</p>
  
  <pre><code>&lt;http auto-config="true"&gt;
      &lt;intercept-url pattern="/"  access="ROLE_USER"/&gt;
      &lt;form-login
          login-page="/login"
          authentication-failure-url="/login?error"
          username-parameter="username"
          password-parameter="password"/&gt;
      &lt;logout logout-success-url="/login?logout"/&gt;
      &lt;csrf/&gt;
  &lt;/http&gt;
  
  &lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name="root" password="root" authorities="ROLE_USER"/&gt;
          &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>