java - How exactly works the Spring Security intercept-url's? -

java - How exactly works the Spring Security intercept-url's? -

i studying spring security , finding difficulties understand intercept-url's concept , reply questiong find on study material:

in order have write multiple intercept-url's?

so, on study material, found practical example:

<beans> <security:http> <security:intercept-url pattern="/accounts/edit*" access="role_admin" /> <security:intercept-url pattern="/accounts/account*" access="role_admin,role_user" /> <security:intercept-url pattern="/accounts/**" access="is_authenticated_fully" /> <security:intercept-url pattern="/customers/**" access="is_authenticated_anonymously" /> </security:http> </beans>

and specified that:

intercept-urls evaluated in order listed: first match used, set specific matches first.

but exatly means?

so know intercept-url's of security namespace used define url secure (correct me if asserting wrong thing).

so in previous illustration secured these urls:

/accounts/edit* /accounts/account* /accounts/** /customers/**

but exatly represent next access roles?

for illustration /accounts/edit* url specified access="role_admin"

for /accounts/account* url specified access="role_admin,role_user"

and on. means? think means, abssolutly not sure it, if user seek access /accounts/edit* have administrator instead if seek access /accounts/account* administrator normal user.

is interpretation right or not correct?

if right how can specify if user "belong" role_admin or role_user? represent , definied?

and means intercept-urls evaluated in order listed: first match used, set specific matches first ?

roles can defined arbitrarily , permission access set each role like.

the intercept urls need listed to the lowest degree specific, because if set to the lowest degree specific 1 first, this:

pattern="/foo/bar/**" pattern="/foo/bar/baz*"

when navigates /foo/bar/baz, permission settings /foo/bar applied, because matched first in list of intercept urls. requires more effort on part of developer, faster matching exact string on every url in list. hope helps.

java spring spring-mvc spring-security