title: Spring Security Authenticated User only
body: <p>I just started to read on Spring Security 3.1 and I would like to know how I can enforce user to authenticate through my login page before accessing any pages on my system. On a tutorial I see the following code</p>
  
  <pre><code>&lt;http use-e xpressions="true"&gt;
      &lt;intercept-url pattern="/index.jsp" access="permitAll" /&gt;
      &lt;intercept-url pattern="/secure/extreme/**" access="hasRole('supervisor')" /&gt;
      &lt;intercept-url pattern="/secure/**" access="isAuthenticated()" /&gt;
      &lt;intercept-url pattern="/listAccounts.html" access="isAuthenticated()" /&gt;
      &lt;intercept-url pattern="/post.html" access="hasAnyRole('supervisor','teller')" /&gt;
      &lt;intercept-url pattern="/**" access="denyAll" /&gt;
      &lt;form-login /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>From the above configuration I can see that I have to maintain the list of url pattern. Is there a way to simplify this that every user has to login through "/login" before can access any other page ?</p>
  
  <p>EDIT:</p>
  
  <p>I have edited my configuration as below and its working as I expected</p>
  
  <pre><code>&lt;http auto-config="true" use-expressions="true"&gt;
      &lt;intercept-url pattern="/login" access="permitAll" /&gt;
      &lt;intercept-url pattern="/loginfailed" access="permitAll" /&gt;
      &lt;intercept-url pattern="/logout" access="permitAll" /&gt;
      &lt;form-login login-page="/login" default-target-url="/welcome"
          authentication-failure-url="/loginfailed" /&gt;
      &lt;logout logout-success-url="/login" /&gt;
      &lt;intercept-url pattern="/**" access="isAuthenticated()" /&gt;
  &lt;/http&gt;
  </code></pre>