title: Spring post redirects to access-denied while get works
body: <p>I apologize for a somewhat duplicate post, I asked a question about this yesterday however I did not do a good job of stating the problem and because of this the feedback was not useful. I have since learned more about the problem and can put it in a more clear and concise way which will hopefully help solve this.</p>
  
  <p>Whenever I try to post to a page the controller maps the url to  the access-denied-handler as specified by mvc-dispatch-servlet.xml. If I try to get to a page then it hits the correct @requestmapping and everything is ok.</p>
  
  <p><img src="https://i.stack.imgur.com/fx4XV.png" alt="Get and post to the same url getting different results">
  I have tried adding     </p>
  
  <pre><code>&lt;intercept-url pattern="/pages/ReceiveFile" access="permitAll"/&gt;
  </code></pre>
  
  <p>which does nothing. </p>
  
  <p>I have just recently narrowed this problem down to </p>
  
  <pre><code>&lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>which seems to be blocking the post operations. If I change this to /pages/* then I can post to a page that is /ReceiveFile because it is mapped that way in web.xml. This skips the main controller altogether. With that setting if I try to go to pages/ReceiveFile it still goes through the controller and goes to the 403 page. I don't believe bypassing my controller with all post operations is a good permanent solution.</p>
  
  <p>How do I allow these post operations to go through?</p>
  
  <p>Thanks!</p>
  
  <p><strong>Main Controller.java</strong>
  some code cut to reduce unnecessary length </p>
  
  <pre><code>@Controller
  public class MainController {
    String URLroot = "pages/";
  
    @PreAuthorize("hasRole('_discover')")
    @RequestMapping(value = {"/discover/**" }, method = RequestMethod.GET)
    public ModelAndView discover(HttpServletRequest request) {
      StringBuffer mapping = request.getRequestURL();
      String URLoffset = getURLoffset(mapping);
  
      ModelAndView model = new ModelAndView();
      model.addObject("title", "Spring Security Login Form - Database Authentication");
      model.addObject("message", "This is default page no longer!");
      model.setViewName(URLoffset);
      return model;
  
    }
  
    /**
     * Upload single file using Spring Controller
     */
    @RequestMapping(value = "/ReceiveFile", method = {RequestMethod.POST,RequestMethod.GET})
    public ModelAndView test(){
  
      //Do useful things which require post.....
  
  
      ModelAndView model = new ModelAndView();
      model.setViewName("springtest");
      return model;
    }
  
  
    @RequestMapping(value = "/admin**", method = RequestMethod.GET)
    public ModelAndView adminPage(HttpServletRequest request) {
      StringBuffer mapping = request.getRequestURL();
      String URLoffset = getURLoffset(mapping);
  
      ModelAndView model = new ModelAndView();
      model.addObject("title", "Spring Security Login Form - Database Authentication");
      model.addObject("message", "This page is for ROLE_ADMIN only!");
      model.setViewName(URLoffset);
  
      return model;
  
    }
  
    @RequestMapping(value = "/signout", method = { RequestMethod.POST, RequestMethod.GET })
    public ModelAndView login() {
  
      ModelAndView model = new ModelAndView();
      model.setViewName("signout");
      return model;
  
    }
  
    @RequestMapping(value = "/login", method = RequestMethod.GET)
    public ModelAndView login(@RequestParam(value = "error", required = false) String error,
                              @RequestParam(value = "logout", required = false) String logout) {
  
      ModelAndView model = new ModelAndView();
      if (error != null) {
        model.addObject("error", "Invalid username and password!");
      }
  
      if (logout != null) {
        model.addObject("msg", "You've been logged out successfully.");
      }
      model.setViewName("login");
      return model;
  
    }
  
    //for 403 access denied page
    @RequestMapping(value = "/403", method = { RequestMethod.POST, RequestMethod.GET })
    public ModelAndView accesssDenied() {
  
      ModelAndView model = new ModelAndView();
  
      //check if user is logged in
      Authentication auth = SecurityContextHolder.getContext().getAuthentication();
      if (!(auth instanceof AnonymousAuthenticationToken)) {
  //      UserDetails userDetail = (UserDetails) auth.getPrincipal();
        System.out.println(auth.getName());
        model.addObject("username", auth.getName());
  
      }
  
      model.setViewName("/403");
      return model;
  
    }
  
    /**
     * Upload single file using Spring Controller
     */
    @RequestMapping(value = "/uploadFile2", method = {RequestMethod.POST,RequestMethod.GET})
    public @ResponseBody
    String uploadFileHandler(@RequestParam("name") String name,
            @RequestParam("file") MultipartFile file) {
  
        if (!file.isEmpty()) {
            try {
                byte[] bytes = file.getBytes();
  
                // Creating the directory to store file
                String rootPath = System.getProperty("catalina.home");
                File dir = new File(rootPath + File.separator + "tmpFiles");
                if (!dir.exists())
                    dir.mkdirs();
  
                // Create the file on server
                File serverFile = new File(dir.getAbsolutePath()
                        + File.separator + name);
                BufferedOutputStream stream = new BufferedOutputStream(
                        new FileOutputStream(serverFile));
                stream.write(bytes);
                stream.close();
  
                instance.debug("FileUploadController" + " uploadFileHandler", "Server File Location=" + serverFile.getAbsolutePath());
  
  
                return "You successfully uploaded file=" + name;
            } catch (Exception e) {
                return "You failed to upload " + name + " =&gt; " + e.getMessage();
            }
        } else {
            return "You failed to upload " + name
                    + " because the file was empty.";
        }
    }
  
  
  }
  </code></pre>
  
  <p><strong>mvc-dispatch-servlet.xml</strong></p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:mvc="http://www.springframework.org/schema/mvc"
      xsi:schemaLocation="
          http://www.springframework.org/schema/beans     
          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
          http://www.springframework.org/schema/context 
          http://www.springframework.org/schema/context/spring-context-3.0.xsd
          http://www.springframework.org/schema/mvc
          http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd"&gt;
  
      &lt;context:component-scan base-package="com.mkyong.*" /&gt;
      &lt;!-- Currently not working. Made a work around by having resources at /resources and pages at /pages --&gt;
    &lt;mvc:resources location="/resources/" mapping="/resources/" /&gt;
  
      &lt;!-- also add the following beans to get rid of some exceptions --&gt;
      &lt;bean
          class="org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter" /&gt;
      &lt;bean
          class="org.springframework.web.servlet.mvc.annotation.DefaultAnnotationHandlerMapping"&gt;
      &lt;/bean&gt;
  
      &lt;bean id="multipartResolver"
          class="org.springframework.web.multipart.commons.CommonsMultipartResolver"&gt;
          &lt;!-- setting maximum upload size --&gt;
          &lt;property name="maxUploadSize"&gt; 
              &lt;value&gt;100000&lt;/value&gt;
          &lt;/property&gt;        
      &lt;/bean&gt;
  
      &lt;bean
          class="org.springframework.web.servlet.view.InternalResourceViewResolver"&gt;
          &lt;property name="prefix"&gt;
              &lt;value&gt;/WEB-INF/pages/&lt;/value&gt;
          &lt;/property&gt;
          &lt;property name="suffix"&gt;
              &lt;value&gt;.jsp&lt;/value&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>spring-security.xml</strong></p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:context="http://www.springframework.org/schema/context"  
      xmlns:beans="http://www.springframework.org/schema/beans" 
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-3.2.xsd
      http://www.springframework.org/schema/context 
    http://www.springframework.org/schema/context/spring-context-3.0.xsd"&gt;
  
      &lt;context:component-scan base-package="com.mkyong.*" /&gt;
      &lt;!-- enable use-expressions --&gt;
      &lt;http auto-config="true" use-expressions="true"&gt;
          &lt;!-- login page must be available to all. The order matters, if this is after something which secures the page this will fail. --&gt;
  &lt;!--        &lt;intercept-url pattern="/SignupUserServlet" access="permitAll"/&gt; --&gt;
          &lt;intercept-url pattern="/pages/ReceiveFile" access="permitAll"/&gt; 
          &lt;intercept-url pattern="/pages/fileUpdate2" access="permitAll"/&gt;
          &lt;intercept-url pattern="/pages/login" access="permitAll" /&gt;
          &lt;intercept-url pattern="/pages/admin/**" access="hasRole('_admin')" /&gt;
          &lt;intercept-url pattern="/pages/trade/**" access="hasRole('_trader')" /&gt;
          &lt;intercept-url pattern="/pages/discover/**" access="hasRole('_users')" /&gt;       
          &lt;!-- access denied page --&gt;
          &lt;access-denied-handler error-page="/pages/403" /&gt;
          &lt;form-login 
              login-page="/pages/login" 
              default-target-url="/pages/common/redirectportal" 
              authentication-failure-url="/pages/login?error" 
              username-parameter="username"
              password-parameter="password" /&gt;
          &lt;logout logout-url="/pages/logout" logout-success-url="/pages/login?logout" /&gt;
          &lt;!-- enable csrf protection --&gt;
          &lt;csrf/&gt;
      &lt;/http&gt;
  
      &lt;!-- Select users and user_roles from database --&gt;
      &lt;authentication-manager&gt;
          &lt;authentication-provider ref="customAuthenticationProvider"/&gt;
          &lt;!--&lt;jdbc-user-service data-source-ref="dataSource"
                  users-by-username-query=
                      "select email,pwhash, enabled from users where email=?"
                  authorities-by-username-query=
                      "select email, groupname from usergroups where email =?  " /&gt; 
          &lt;/authentication-provider&gt; --&gt;
      &lt;/authentication-manager&gt;
  
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p><strong>web.xml</strong></p>
  
  <pre><code>&lt;web-app id="WebApp_ID" version="2.4"
      xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee 
      http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"&gt;
  
  
          &lt;!-- Spring MVC --&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
        &lt;servlet&gt;
      &lt;servlet-name&gt;InitServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;servlet.InitServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;configfile&lt;/param-name&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;2&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
  
    &lt;servlet&gt;
      &lt;servlet-name&gt;AdminServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;servlet.admin.AdminServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;3&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
  
    &lt;servlet&gt;
      &lt;servlet-name&gt;UserServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;servlet.user.UserServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;4&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
  
    &lt;servlet&gt;
      &lt;servlet-name&gt;SignupUserServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;servlet.user.SignupUserServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;5&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
  
    &lt;servlet&gt;
     &lt;servlet-name&gt;ReceiveFile&lt;/servlet-name&gt;
      &lt;servlet-class&gt;servlet.user.ReceiveFile&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;6&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
  
    &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/pages/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
    &lt;servlet-mapping&gt;
     &lt;servlet-name&gt;AdminServlet&lt;/servlet-name&gt;
     &lt;url-pattern&gt;/AdminServlet&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
  
    &lt;servlet-mapping&gt;
     &lt;servlet-name&gt;UserServlet&lt;/servlet-name&gt;
     &lt;url-pattern&gt;/UserServlet&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
  
    &lt;servlet-mapping&gt;
     &lt;servlet-name&gt;SignupUserServlet&lt;/servlet-name&gt;
     &lt;url-pattern&gt;/SignupUserServlet&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
  
    &lt;servlet-mapping&gt;
     &lt;servlet-name&gt;ReceiveFile&lt;/servlet-name&gt;
     &lt;url-pattern&gt;/ReceiveFile&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
              /WEB-INF/spring-security.xml,
              /WEB-INF/spring-database.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;!-- Spring Security --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
  &lt;/web-app&gt;
  </code></pre>