Spring web security: unable to access a page after successful login
<p>I am trying to understand the spring-web security. For that I created a web application with a login page and two different users.</p>

<ol>
<li>Admin</li>
<li>User/Guest</li>
</ol>

<p>LoginController class handles three types of URLs.</p>

<pre><code>/*
  Used to guide the user to login page
*/
@RequestMapping(value="/login/login.htm", method=RequestMethod.GET)
public ModelAndView login(){
    ModelAndView modelAndView = new ModelAndView("login");
    System.out.println("Rendering login page.................");
    return modelAndView;
}

/*
 Process the successful login and redirects user to Admin/User page as per the role.
*/
@RequestMapping(value="/login/success")
public ModelAndView loginSuccess(HttpServletRequest request){
    ModelAndView modelAndView = new ModelAndView();

     Set&lt;String&gt; roles = AuthorityUtils
                .authorityListToSet(SecurityContextHolder.getContext()
                        .getAuthentication().getAuthorities());
    System.out.println("ROLES: "+roles);

    if(roles.contains("USER_ADMIN")){
        modelAndView.setViewName("admin");
    }else{
        modelAndView.setViewName("user");
    }

    return modelAndView;
}

/* 
  Admin page has a hyper link to access the manage user page. It is handled here.
*/
@RequestMapping(value="/admin/manageUser.htm", method=RequestMethod.GET)
public ModelAndView manageUser(){
    ModelAndView modelAndView = new ModelAndView("manageUser");
    return modelAndView;
}
</code></pre>

<p><strong>web.xml</strong></p>

<blockquote>
<pre><code>&lt;context-param&gt;
  &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
  &lt;param-value&gt;/WEB-INF/SecurityConfig.xml&lt;/param-value&gt;
&lt;/context-param&gt;

&lt;listener&gt;
  &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
&lt;/listener&gt;


&lt;servlet&gt;
  &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
  &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
  &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
&lt;/servlet&gt;
&lt;servlet-mapping&gt;
  &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
  &lt;url-pattern&gt;/&lt;/url-pattern&gt;
&lt;/servlet-mapping&gt;


&lt;!-- Spring Security --&gt;
&lt;filter&gt;
  &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
  &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
&lt;/filter&gt;

&lt;filter-mapping&gt;
  &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
  &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
&lt;/filter-mapping&gt;
</code></pre>
</blockquote>

<p>in spring security I am restricting all urls with '<strong>admin/</strong>' &amp; '<strong>user/</strong>'.</p>

<blockquote>
<pre><code>&lt;http auto-config="true"&gt;
    &lt;intercept-url pattern="/admin/**" access="hasRole('USER_ADMIN')"/&gt;
    &lt;intercept-url pattern="/user/**" access="hasRole('USER_GUEST')"/&gt;
    &lt;form-login login-page="/login/login.htm" 
        username-parameter="userName" password-parameter="password"
        login-processing-url="/j_spring_security_check"
        authentication-success-forward-url="/login/success"/&gt;

    &lt;remember-me/&gt;

&lt;/http&gt;

&lt;authentication-manager&gt;
    &lt;authentication-provider&gt;
        &lt;user-service&gt;
            &lt;user name="renju" password="12345" authorities="USER_ADMIN"/&gt;
            &lt;user name="guest" password="guest"  authorities="USER_GUEST"/&gt;
        &lt;/user-service&gt;
    &lt;/authentication-provider&gt;
&lt;/authentication-manager&gt;
</code></pre>
</blockquote>

<p>When i try '<a href="http://localhost:8080/SpringWebSecurityThree-0.0.1-SNAPSHOT/login/login.htm" rel="nofollow noreferrer">http://localhost:8080/SpringWebSecurityThree-0.0.1-SNAPSHOT/login/login.htm</a>', application opens up the custom login page.
<a href="https://i.stack.imgur.com/RsHGq.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RsHGq.png" alt="enter image description here"></a></p>

<p>On giving the admin username and password, application opens up the admin page.</p>

<p><a href="https://i.stack.imgur.com/Tcait.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Tcait.png" alt="enter image description here"></a></p>

<p>Now when i click on 'ManageUser', I am expecting the application to take me tothe manageuser page. But it says 'Access Denied'.</p>

<p><a href="https://i.stack.imgur.com/SM6SC.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/SM6SC.png" alt="enter image description here"></a></p>

<p>I believe it has something to do with the intercept-url's given.</p>

<p>Could you please help me to resolve this?</p>

<p>I am posting jsp pages too..</p>

<p><strong>login.jsp</strong></p>

<pre><code>&lt;%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%&gt;
&lt;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%&gt;
&lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
&lt;html&gt;
&lt;head&gt;
&lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
&lt;title&gt;Insert title here&lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;
    &lt;c:if test="${not empty error}"&gt;
        &lt;c:out value="${error}"&gt;&lt;/c:out&gt;
    &lt;/c:if&gt;
    &lt;form action="../j_spring_security_check" method="post"&gt;

        &lt;table&gt;

            &lt;tr&gt;
                &lt;td&gt;UserName&lt;/td&gt;
                &lt;td&gt;&lt;input type="text" name="userName"&gt;&lt;/td&gt;
            &lt;/tr&gt;
            &lt;tr&gt;
                &lt;td&gt;Password&lt;/td&gt;
                &lt;td&gt;&lt;input type="password" name="password"&gt;&lt;/td&gt;
            &lt;/tr&gt;

                        &lt;tr&gt;
                &lt;td&gt;&lt;input type="submit" name="LOGIN"&gt;&lt;/td&gt;
            &lt;/tr&gt;
        &lt;/table&gt;

        &lt;input type="hidden" name="${_csrf.parameterName}"
            value="${_csrf.token}" /&gt;


    &lt;/form&gt;

&lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p><strong>admin.jsp</strong></p>

<pre><code>&lt;%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%&gt;
    &lt;%@ page session="true" %&gt;
&lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
&lt;html&gt;
&lt;head&gt;
&lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
&lt;title&gt;Insert title here&lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;
    Admin Page !!!!!!!!!!
    &lt;a href="${pageContext.request.contextPath}/admin/manageUser.htm"&gt;ManageUser&lt;/a&gt;
    &lt;% session.setAttribute("userType", "admin"); %&gt;
&lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p><strong>manageuser.jsp</strong></p>

<pre><code>&lt;%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%&gt;
&lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
&lt;%@ page session="true" %&gt;
&lt;html&gt;
&lt;head&gt;
&lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
&lt;title&gt;Insert title here&lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;
    Managing User....
    &lt;br/&gt;
    Logged In UserType: 
    &lt;%
        out.println(session.getAttribute("userType"));
    %&gt;
&lt;/body&gt;
&lt;/html&gt;
</code></pre>