java - Whitelisting a web resource using spring security -

the standard method secure web application forbid unauthenticated access , white-list specific resources.

all of following xml fragments allow access resource, different though implications:

<http pattern="/favicon.ico" security="none" />  <intercept-url pattern="/favicon.ico" filters="none" />  <intercept-url pattern="/favicon.ico" access="permitall"/>   <intercept-url pattern="/favicon.ico" access="role_anonymous" />  <intercept-url pattern="/favicon.ico" access="is_authenticated_anonymously" /> 

which should used when , under circumstances?

<http pattern="/favicon.ico" security="none" /> 

will bypass security filters completely, want kind of resource we're dealing here (i.e. favicon.ico).

if do

<intercept-url pattern="/favicon.ico" access="is_authenticated_anonymously" /> 

you still able information regarding logged in user (if any) when rendering resource (might useful when rendering page should accessible without login still want able present e.g. user name on rendered page if user logged in).

permitall same thing, el syntax.

role_anonymous appears grant access anonymous users, deny anthenticated ones.

<intercept-url pattern="/favicon.ico" filters="none" /> 

is old syntax, knowledge no longer supported.