Q:

Spring security for overlap URL range

I don't know how to configure spring security to specify different ROLEs for overlaping URLs.
<sec:intercept-url pattern="/app/ws**" access="ROLE_WEBSERVICE"/>
<sec:intercept-url pattern="/app**" access="ROLE_ADMIN"/>

I need to accept user with role ROLE_WEBSERVICE on /app/ws** even if this user does not have user ROLE_ADMIN.
Could you point me to the correct place of documentation? I could not find it. Thanks.

A:

If you switch to an expression rule instead of the vanilla RoleVoter you get more flexibility, e.g.
<http use-expressions="true">
    ...
    <intercept-url pattern="/app/ws**" access="hasRole('ROLE_WEBSERVICE') and hasRole('ROLE_ADMIN')"/>
    <intercept-url pattern="/app**" access="hasRole('ROLE_ADMIN')"/>
    ...

