From f660d4296b0b288ab1ab343a06fa435e61acce5e Mon Sep 17 00:00:00 2001
From: Josh Cummings <josh.cummings@gmail.com>
Date: Thu, 6 Oct 2022 10:58:29 -0600
Subject: [PATCH] Update <http> definition

Issue gh-9%
---
 .../resources/applicationContext-security.xml    | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/servlet/xml/java/contacts/src/main/resources/applicationContext-security.xml b/servlet/xml/java/contacts/src/main/resources/applicationContext-security.xml
index f33c57f..e194e94 100644
--- a/servlet/xml/java/contacts/src/main/resources/applicationContext-security.xml
+++ b/servlet/xml/java/contacts/src/main/resources/applicationContext-security.xml
@@ -17,14 +17,14 @@
 		<expression-handler ref="expressionHandler"/>
 	</global-method-security>
 
-	<http request-matcher="ant" realm="Contacts Realm" use-expressions="false">
-		<intercept-url pattern="/" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
-		<intercept-url pattern="/index.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
-		<intercept-url pattern="/hello.htm" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
-		<intercept-url pattern="/login.jsp*" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
-		<intercept-url pattern="/switchuser.jsp" access="ROLE_SUPERVISOR"/>
-		<intercept-url pattern="/login/impersonate" access="ROLE_SUPERVISOR"/>
-		<intercept-url pattern="/**" access="ROLE_USER"/>
+	<http request-matcher="ant" realm="Contacts Realm">
+		<intercept-url pattern="/" access="permitAll"/>
+		<intercept-url pattern="/index.jsp" access="permitAll"/>
+		<intercept-url pattern="/hello.htm" access="permitAll"/>
+		<intercept-url pattern="/login.jsp*" access="permitAll"/>
+		<intercept-url pattern="/switchuser.jsp" access="hasRole('SUPERVISOR')"/>
+		<intercept-url pattern="/login/impersonate" access="hasRole('SUPERVISOR')"/>
+		<intercept-url pattern="/**" access="hasRole('USER')"/>
 
 		<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=1"/>
 		<http-basic/>