From cddd15019c64a5dcc80f505af530a81d99356a43 Mon Sep 17 00:00:00 2001
From: Robert Kohanyi <robert.kohanyi@metapack.com>
Date: Sun, 24 Apr 2016 20:48:07 +0100
Subject: [PATCH] Refined the url pattern for perform_login, remove permitAll
 (it's not needed, works either way)

---
 .../src/main/java/org/baeldung/spring/SecSecurityConfig.java  | 2 +-
 .../src/main/resources/webSecurityConfig.xml                  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/spring-security-mvc-login/src/main/java/org/baeldung/spring/SecSecurityConfig.java b/spring-security-mvc-login/src/main/java/org/baeldung/spring/SecSecurityConfig.java
index 0cc6df19ae..b4d0a6466b 100644
--- a/spring-security-mvc-login/src/main/java/org/baeldung/spring/SecSecurityConfig.java
+++ b/spring-security-mvc-login/src/main/java/org/baeldung/spring/SecSecurityConfig.java
@@ -39,7 +39,7 @@ public class SecSecurityConfig extends WebSecurityConfigurerAdapter {
         .anyRequest().authenticated()
         .and()
         //.requiresChannel()
-        //.antMatchers("/login*", "/perform_log*").requiresSecure()
+        //.antMatchers("/login*", "/perform_login").requiresSecure()
         //.anyRequest().requiresInsecure()
         //.and()
         //.sessionManagement()
diff --git a/spring-security-mvc-login/src/main/resources/webSecurityConfig.xml b/spring-security-mvc-login/src/main/resources/webSecurityConfig.xml
index 0b77e64c74..460f3422d5 100644
--- a/spring-security-mvc-login/src/main/resources/webSecurityConfig.xml
+++ b/spring-security-mvc-login/src/main/resources/webSecurityConfig.xml
@@ -14,12 +14,12 @@
         <!--
         <intercept-url pattern="/anonymous*" access="isAnonymous()" requires-channel="http"/>
         <intercept-url pattern="/login*" access="permitAll" requires-channel="https"/>
-        <intercept-url pattern="/perform_log*" access="permitAll" requires-channel="https"/>
+        <intercept-url pattern="/perform_login" requires-channel="https"/>
         <intercept-url pattern="/**" access="isAuthenticated()" requires-channel="http"/>
         -->
 
         <csrf disabled="true"/>
-        
+
         <form-login login-page='/login.html' login-processing-url="/perform_login" default-target-url="/homepage.html" authentication-failure-url="/login.html?error=true"
             always-use-default-target="true"/>