title: Allow Specific URL patterns to bypass Spring Security Login
body: <p>I have a web application protected by spring security. However, there is one particular URL pattern that I do not want to apply any security to. I've tried a few different approaches, but none of them seem to be working. Whenever I attempt to go to that specific URL, I am forwarded to the <code>spring_security_login</code> page. </p>
  
  <p>A piece of the web.xml:</p>
  
  <pre><code>&lt;!-- NOT SECURE --&gt;
  &lt;servlet&gt;
      &lt;servlet-name&gt;dontSecureServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.com.gov.lol.DontSecure&lt;/servlet-class&gt; 
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;dontSecureServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/dontSecure&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;!-- SECURE --&gt;
  &lt;servlet&gt;
      &lt;servlet-name&gt;secureServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.com.gov.lol.Secure&lt;/servlet-class&gt; 
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;secureServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;*.htm&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;!-- SECURITY FILTER --&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;
      &lt;dispatcher&gt;ERROR&lt;/dispatcher&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>A piece of the security-context.xml:</p>
  
  <pre><code>&lt;!-- This did not work --&gt;
  &lt;http pattern="/dontSecure" security="none" /&gt;
  
  &lt;http entry-point-ref="entryPoint" use-expressions="true"&gt;
      &lt;custom-filter ref="customFilter" position="PRE_AUTH_FILTER" /&gt;
  
      &lt;!-- I've also tried adding the following here (with no luck) --&gt;
      &lt;intercept-url pattern="/dontSecure" filters="none" /&gt;
      &lt;intercept-url pattern="/secureMe" requires-channel="https" /&gt;
      &lt;intercept-url pattern="/secureUs" requires-channel="https" /&gt;
  
  &lt;/http&gt;
  
  &lt;!-- I have even tried adding a separate &lt;http&gt; block just for /dontSecure --&gt;
  &lt;http&gt;
      &lt;intercept-url pattern="/dontSecure" security="none" /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>Again, with any combination of the above configuration, the url <code>/dontSecure</code> is still forwarded to the spring login page.</p>
  
  <p>Any ideas as to what could be causing this?</p>
  
  <p>Cheers.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>From the server logs, it seems that the <code>/dontSecure</code> url is loading the <code>dontSecureServlet</code>. However, an error seems to be generated and I am being forwareded the 404 error page (which is configured as /404.htm, which must be what brings me back to the login page).</p>
  
  <p>I've included some extra snippits from the web.xml that I didn't think were relevant at first.</p>