title: Restrict the access of REST URL's in browser
body: <p>How to restrict the access of REST urls in browser, can any one please guide me what are the necessary changes to made in security.xml. My web app runs on spring MVC framework.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:beans="http://www.springframework.org/schema/beans"   xmlns:p="http://www.springframework.org/schema/p"
  xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
            http://www.springframework.org/schema/security  http://www.springframework.org/schema/security/spring-security.xsd"&gt;
  
  &lt;http pattern="/images/**" security="none" /&gt;
  &lt;http pattern="/styles/**" security="none" /&gt;
  &lt;http pattern="/scripts/**" security="none" /&gt;
  &lt;http pattern="/assets/**" security="none" /&gt;
  
  
  &lt;http auto-config="true"&gt;
      &lt;intercept-url pattern="/app/admin/**" access="ROLE_ADMIN" /&gt;
      &lt;intercept-url pattern="/app/passwordHint*" access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER" /&gt;
      &lt;intercept-url pattern="/app/requestRecoveryToken*" access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER, ROLE_PHYSICIAN, ROLE_PRACTICE_STAFF" /&gt;
      &lt;intercept-url pattern="/app/updatePassword*" access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER, ROLE_PHYSICIAN, ROLE_PRACTICE_STAFF" /&gt;
      &lt;intercept-url pattern="/app/signup*" access="ROLE_ADMIN" /&gt;
      &lt;intercept-url pattern="/app/practice*" access="ROLE_ADMIN"/&gt;   
      &lt;!-- &lt;intercept-url pattern="/app/patientReports*" access="ROLE_ADMIN"/&gt; --&gt;        
      &lt;intercept-url pattern="/app/mediaFile/**" access="ROLE_ANONYMOUS"/&gt;
      &lt;intercept-url pattern="/app/**" access="ROLE_ADMIN, ROLE_USER, ROLE_PHYSICIAN, ROLE_PRACTICE_STAFF" /&gt;
      &lt;form-login login-page="/login" authentication-failure-url="/login?error=true" login-processing-url="/j_security_check" /&gt;
      &lt;remember-me user-service-ref="userDao" key="e37f4b31-0c45-11dd-bd0b-0800200c9a66" /&gt;
  &lt;/http&gt;
  
  &lt;authentication-manager&gt;
      &lt;authentication-provider user-service-ref="userDao"&gt;
          &lt;password-encoder ref="passwordEncoder"&gt;
          &lt;/password-encoder&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  
  
  &lt;!-- Override the default password-encoder (BCrypt) by uncommenting the following and changing the class --&gt;
  &lt;!-- &lt;bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/&gt; --&gt;
  
  &lt;global-method-security&gt;
      &lt;protect-pointcut expression="execution(* *..service.UserManager.getUsers(..))" access="ROLE_ADMIN" /&gt;
      &lt;protect-pointcut expression="execution(* *..service.UserManager.removeUser(..))" access="ROLE_ADMIN" /&gt;
  &lt;/global-method-security&gt;
  </code></pre>
  
  <p></p>