title: Multiple <http> elements in Spring security
body: <p>Recently Spring Security has given the opportunity to configure several <code>&lt;http&gt;</code> elements. I'm trying to set a configuration for all the urls which maps the pattern /foo/* and another for the rest. Now I have two login pages one set in /login and the other in /foo login. So I want that all the urls which map /foo/** do the login against /foo/login.</p>
  <p>I have created a configuration like the one below, but when I enter an url like /foo/something (which shouldn't be allowed to the anonymous user) instead of going to /foo/login it goes to /login.</p>
  <p>The Spring Security version is <strong>3.1.0.RC1</strong>.
  Any idea of what may be happening?</p>
  <pre><code>&lt;sec:http auto-config=&quot;true&quot; pattern=&quot;/foo/**&quot; entry-point-ref=&quot;ajaxAuthenticationEntryPoint&quot;&gt;
      &lt;sec:intercept-url pattern=&quot;/foo/login&quot; access=&quot;ROLE_ANONYMOUS,ROLE_BASIC,ROLE_ADMIN&quot; /&gt;
      ...
      &lt;!-- other sec:intercepts for some /foo/* urls --&gt;
      ...
      &lt;sec:intercept-url pattern=&quot;/foo/**&quot; access=&quot;ROLE_BASIC&quot; /&gt;
      
      &lt;sec:custom-filter before=&quot;SECURITY_CONTEXT_FILTER&quot; ref=&quot;basicProcessingFilter&quot; /&gt;
      
      &lt;sec:form-login login-page=&quot;/foo/login&quot; authentication-failure-url=&quot;/foo/login&quot; default-target-url=&quot;/index&quot; always-use-default-target=&quot;true&quot; /&gt;
      
      &lt;sec:session-management&gt;
          &lt;sec:concurrency-control max-sessions=&quot;1&quot; error-if-maximum-exceeded=&quot;true&quot; expired-url=&quot;/login&quot; /&gt;
      &lt;/sec:session-management&gt;
  &lt;/sec:http&gt;
  
  &lt;sec:http auto-config=&quot;true&quot; pattern=&quot;/**&quot; entry-point-ref=&quot;ajaxAuthenticationEntryPoint&quot;&gt;
      &lt;!-- some sec:intercepts for some urls --&gt;
      ...
      
      &lt;sec:intercept-url pattern=&quot;/**&quot; access=&quot;ROLE_ADMIN&quot; /&gt;
      
      &lt;sec:custom-filter before=&quot;SECURITY_CONTEXT_FILTER&quot; ref=&quot;basicProcessingFilter&quot; /&gt;
      
      &lt;sec:form-login login-page=&quot;/login&quot; default-target-url=&quot;/index&quot; always-use-default-target=&quot;true&quot; /&gt;
              
      &lt;sec:session-management&gt;
          &lt;sec:concurrency-control max-sessions=&quot;1&quot; error-if-maximum-exceeded=&quot;true&quot; expired-url=&quot;/login&quot; /&gt;
      &lt;/sec:session-management&gt;
  &lt;/sec:http&gt;
  </code></pre>