Spring Security URL pattern configuration

This one should be quite simple. But I've been stuck with it for a while. I'm trying to implement Spring Security in my web application.

By default, all URL's should be publically accessible. Except for following:

• /nl/favorieten/
• /fr/favorites/

I've tried several things, ending up with the following:

<http auto-config="true" access-denied-page="/login">
    <intercept-url pattern="/*/favori*" access="IS_AUTHENTICATED_FULLY" />
    <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <form-login
       always-use-default-target="true"
       login-page="/login"
       default-target-url="/"
       authentication-failure-url="/login?login_error=1" />
    <logout i开发者_Python百科nvalidate-session="false" logout-url="/logout" />
</http>

obviously without success. I've tried just about any combination of regex, ordering the rules, changing roles. But nothing seems to redirect my request to /login.

Except ofcourse if I say /** should be IS_AUTHENTICATED_FULLY

Simply put:

<intercept-url pattern="/nl/favorieten/*" access="IS_AUTHENTICATED_FULLY" />
<intercept-url pattern="/fr/favorites/*" access="IS_AUTHENTICATED_FULLY" />

Yeah i think the problem here was that the /** rule matched everything, so any other rule you applied wouldn't work.