title: Spring Method Level Security fails on second call
body: <p>I want to use method level security on my GWT application. I'm trying to use Spring Security 3.1, as I found a working example <a href="http://blog.maxmatveev.com/2011/06/gwt-and-spring-security-integration-as.html" rel="nofollow noreferrer">here</a>, but it doesn't use form-login. After reading <a href="https://stackoverflow.com/questions/3779839/unable-to-retrieve-security-context-from-within-spring-jersey/3785587#3785587">this answer</a> the first method call successfully obtains the SecurityContext, but then clears it before the next call:</p>
  
  <pre><code>[org.springframework.security.web.context.HttpSessionSecurityContextRepository] - Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl@6fe9f089: Authentication: org.example.MyAppName.server.auth.MyAppNameUserAuthentication@6fe9f089'
  ...
  [org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor] - Authorization successful
  ...
  [org.springframework.security.web.context.SecurityContextPersistenceFilter] - SecurityContextHolder now cleared, as request processing completed
  ...
  [org.springframework.security.web.context.HttpSessionSecurityContextRepository] - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
  [org.springframework.security.web.context.SecurityContextPersistenceFilter] - SecurityContextHolder now cleared, as request processing completed
  ...
  [org.springframework.security.web.context.HttpSessionSecurityContextRepository] - HttpSession returned null object for SPRING_SECURITY_CONTEXT
  </code></pre>
  
  <p>The second call happens straight after the first and just after the user logs in.</p>
  
  <p>Is it because I followed the other answer and removed <code>&lt;http pattern="/MyAppName/**" security="none" /&gt;</code> and added <code>&lt;intercept-url pattern="/MyAppName/**" access="permitAll()" /&gt;</code>?</p>
  
  <p>My filters are as follows:</p>
  
  <pre><code>&lt;http pattern="/favicon.ico" security="none" /&gt;
  
  &lt;http access-decision-manager-ref="accessDecisionManager" use-expressions="true" auto-config="false" entry-point-ref="LoginUrlAuthenticationEntryPoint"&gt;
    &lt;form-login login-page="/Login.html" always-use-default-target="true" default-target-url="/Main.html?gwt.codesvr=127.0.0.1:9997" /&gt;
    &lt;intercept-url pattern="/Login.html" access="permitAll()" /&gt;
    &lt;intercept-url pattern="/Login2.html" access="permitAll()" /&gt;
    &lt;intercept-url pattern="/MyAppName/**" access="permitAll()" /&gt;
    &lt;intercept-url pattern="/**" access="isAuthenticated()" /&gt;
    &lt;logout delete-cookies="JSESSIONID" logout-success-url="/Login.html" /&gt;
    &lt;remember-me token-validity-seconds="86400" key="key" user-service-ref="userDetailsService" /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>Following the example I obtained I use AspectJ for the global method security, but would not use it if I could get that working:</p>
  
  <pre><code>&lt;global-method-security secured-annotations="enabled" pre-post-annotations="enabled" mode="aspectj" proxy-target-class="true" &gt;
    &lt;expression-handler ref="expressionHandler"/&gt;
  &lt;/global-method-security&gt;
  </code></pre>
  
  <p>Thank you for taking the time to read this</p>
  
  <p>Please let me know if more detail is needed.</p>