title: AngularJS and Spring Security. How to handle AngularJS Urls with Spring Security
body: <p>Let me explain my problem.
  I have implemented a site in AngularJS that is accessed like this:</p>
  
  <pre><code>http://localhost:8080/example/resources/#/
  </code></pre>
  
  <p>Here we can call different pages, for example a Login page:</p>
  
  <pre><code>http://localhost:8080/example/resources/#/login
  </code></pre>
  
  <p>admin page:</p>
  
  <pre><code>http://localhost:8080/example/resources/#/admin
  </code></pre>
  
  <p>user page:</p>
  
  <pre><code>http://localhost:8080/example/resources/#/user
  </code></pre>
  
  <p>Now, I have implemented spring security in the example in order to catch every call and check if it has ROLE_USER privileges. So far so good, I have done it like this configuration in Spring security context file:</p>
  
  <pre><code>&lt;security:http create-session="stateless" entry-point-ref="restAuthenticationEntryPoint"
   authentication-manager-ref="authenticationManager"&gt;
  
      &lt;security:custom-filter ref="customRestFilter" position="BASIC_AUTH_FILTER" /&gt;
       &lt;security:intercept-url pattern="/**" access="ROLE_USER" /&gt;       
  &lt;/security:http&gt;
  </code></pre>
  
  <p>This configuration checks for every url called, if the user has the proper ROLES, and it works fine, throws 401 Unauthorized page.</p>
  
  <p>The problem I`m having is that when I put the login page to be accessed by everybody I'll do  it this way:</p>
  
  <pre><code>&lt;security:http create-session="stateless" entry-point-ref="restAuthenticationEntryPoint"
   authentication-manager-ref="authenticationManager"&gt;
  
      &lt;security:custom-filter ref="customRestFilter" position="BASIC_AUTH_FILTER" /&gt;
        &lt;security:intercept-url pattern="/login**" access="ROLE_ANONYMOUS" /&gt; 
       &lt;security:intercept-url pattern="/**" access="ROLE_USER" /&gt;       
  &lt;/security:http&gt;
  </code></pre>
  
  <p>But I dont know why spring security is not catching this URL. Maybe Angular manages the URL differently. </p>
  
  <p>Finally i have tried deleting the <code>&lt;security:intercept-url pattern="/**" access="ROLE_USER" /&gt;</code>  and giving /login** access to ROLE_USER only, but this page was not found. Does anybody know what could be happening here?</p>
  
  <p>Thanks in advance!!!</p>