title: intercept-url pattern /** causing 404 error
body: <p>I have searched here, google and springsource for this and could not find a solution that worked for me. I have the below spring-security.xml and when I use the pattern </p>
  
  <p><code>&lt;intercept-url pattern="/**" access="hasRole('ROLE_USER')" /&gt;</code> </p>
  
  <p>This gives me a 404 error when it redirects to the login page. But this does not happen if I use</p>
  
  <p><code>&lt;intercept-url pattern="/index*" access="hasRole('ROLE_USER')" /&gt;</code> </p>
  
  <p>But obviously this does not secure the rest of the app.</p>
  
  <p>I'm sure this is something simple I am overlooking but the closest thing I could find was <a href="https://stackoverflow.com/questions/2760011/spring-security-3-0-intercept-url-all-pages-require-authentication-but-one">this stack overflow question</a>, Which I have already incorperated in my xml file below but still have the same issue. I have tried this without <code>use-expressions="true"</code> and I have tried switching the <code>intercept-url</code>'s around (I'm not 100% but I am fairly sure that the <code>/**</code> pattern should be the last one as I believe urls are matched in the same order as declared)</p>
  
  <p>Any advice/help would be great</p>
  
  <p><strong>spring-security.xml</strong></p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans" 
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-3.0.3.xsd"&gt;
  
      &lt;http auto-config="true" use-expressions="true"&gt;
          &lt;intercept-url pattern="/login" filters="none" access="permitAll" /&gt;
          &lt;intercept-url pattern="/**" access="hasRole('ROLE_USER')" /&gt;
          &lt;form-login login-page="/login" default-target-url="/welcome"
              authentication-failure-url="/loginfailed" /&gt;
          &lt;logout logout-success-url="/logout" /&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
        &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name="username" password="password" authorities="ROLE_USER" /&gt;
          &lt;/user-service&gt;
        &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
  &lt;/beans:beans&gt;
  </code></pre>
  
  <h2>Update</h2>
  
  <p>Just in case it is a factor I'm using Spring and Spring security 3.0.4.RELEASE</p>
  
  <h2>Answer</h2>
  
  <p>Following Kris's advice I changed </p>
  
  <pre><code>&lt;intercept-url pattern="/login" filters="none" access="permitAll" /&gt;
  </code></pre>
  
  <p>to:</p>
  
  <pre><code>&lt;intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
  </code></pre>
  
  <p>This caused a 500 Error due to the exception</p>
  
  <pre><code>    SpelEvaluationException: EL1008E:(pos 0): Field or property
       'IS_AUTHENTICATED_ANONYMOUSLY' cannot be found on object of 
  type'org.springframework.security.web.access.expression.WebSecurityExpressionRoot
  </code></pre>
  
  <p>I solved this by changing the <code>IS_AUTHENTICATED_ANONYMOUSLY</code> to <code>isAnonymous()</code></p>
  
  <pre><code>&lt;intercept-url pattern="/login" access="isAnonymous()" /&gt;
  </code></pre>