title: Each role has its own accessible page
body: <p>I create a project where admin and user can log in. I have JSP pages, only the admin can enter there, because access is restricted to the user. The user can go to certain pages.
  I have two pages "allStudents.jsp" - only admin can go there.
  And on this page "allStudentsUser.jsp" - only the user can enter.
  So this is how to write the code in the controller correctly so that Tomkat read my "allStudentsUser.jsp" page.</p>
  
  <p>Student Controller</p>
  
  <pre><code>@Controller
  public class StudentController {
  
      @Autowired
      private ServletContext servletContext;
  
      // Constructor based Dependency Injection
      private StudentService studentService;
  
      public StudentController() {
  
      }
  
      @Autowired
      public StudentController(StudentService studentService) {
          this.studentService = studentService;
      }
  
      @RequestMapping(value = "/allStudents",  method = {RequestMethod.GET, RequestMethod.POST})
  
      public ModelAndView displayAllUser() {
          System.out.println("User Page Requested : All Students");
          ModelAndView mv = new ModelAndView();
          List&lt;Student&gt; studentList = studentService.getAllStudents();
          mv.addObject("studentList", studentList);
          mv.setViewName("allStudents");
          return mv;
      }
  
      @RequestMapping(value = "/allStudentsUser",  method = {RequestMethod.GET, RequestMethod.POST})
  
      public ModelAndView displayAllUsers() {
          System.out.println("User Page Requested : All Students");
          ModelAndView mv = new ModelAndView();
          List&lt;Student&gt; studentList = studentService.getAllStudents();
          mv.addObject("studentList", studentList);
          mv.setViewName("allStudentsUser");
          return mv;
      }
  
  
  
      @RequestMapping(value = "/addStudent", method = RequestMethod.GET)
      public ModelAndView displayNewUserForm() {
          ModelAndView mv = new ModelAndView("addStudent");
          mv.addObject("headerMessage", "Add Student Details");
          mv.addObject("student", new Student());
          return mv;
      }
  
      @PostMapping(value = "/addStudent")
      public String saveNewStudent(@RequestParam("name") @NonNull String name,
              @RequestParam("surname") @NonNull String surname,
              @RequestParam("avatar") MultipartFile file)
              throws IOException {
  
          Student student = new Student();
          student.setSurname(surname);
          student.setName(name);
  
          if (file != null &amp;&amp; !file.isEmpty()) {
              student.setAvatar(studentService.saveAvatarImage(file).getName());
          }
  
          studentService.saveStudent(student);
          return "redirect:/allStudents";
      }
  
      @GetMapping(value = "/editStudent/{id}")
      public ModelAndView displayEditUserForm(@PathVariable Long id) {
          ModelAndView mv = new ModelAndView("editStudent");
          Student student = studentService.getStudentById(id);
          mv.addObject("headerMessage", "Редактирование студента");
          mv.addObject("student", student);
          return mv;
      }
  
      @PostMapping(value = "/editStudent")
      public String saveEditedUser(
              @RequestParam("id") Long id,
              @RequestParam("name") String name,
              @RequestParam("surname") String surname,
              @RequestParam("avatar") MultipartFile file) {
  
          try {
  
              studentService.updateStudent(name, surname, file, studentService.getStudentById(id));
  
          } catch (FileSystemException ex) {
              ex.printStackTrace();
          } catch (IOException e) {
              return "redirect:/error";
          }
  
          return "redirect:/allStudents";
      }
  
      @GetMapping(value = "/deleteStudent/{id}")
      public ModelAndView deleteUserById(@PathVariable Long id) {
          studentService.deleteStudentById(id);
          ModelAndView mv = new ModelAndView("redirect:/allStudents");
  
          return mv;
  
      }
  
  }
  </code></pre>
  
  <p>Security Config</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication()
                  .withUser("admin").password(passwordEncoder().encode("1234")).roles("ADMIN")
                  .and()
                  .withUser("user").password(passwordEncoder().encode("user1234")).roles("USER")
                  .and();
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .antMatchers("/allStudentsUser**").permitAll()
                  .antMatchers("/allStudents**").hasRole("ADMIN")
                  .antMatchers("/addStudent/**").hasAnyRole("USER", "ADMIN")
                  .antMatchers("/editStudent/**").hasRole("ADMIN")
                  .antMatchers("/deleteStudent/**").hasRole("ADMIN")
                  .and()
                  .formLogin()
                  .loginPage("/login")
                  .defaultSuccessUrl("/allStudents")
                  .failureUrl("/login?error=true")
                  .and()
                  .logout()
                  .logoutSuccessUrl("/login?logout=true")
                  .and()
                  .csrf().disable();
      }
  
      @Bean
      public PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }
  
  }
  </code></pre>
  
  <p>AllStudents.jsp (for Admin)</p>
  
  <pre><code>&lt;%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" isELIgnored="false"%&gt;
  &lt;%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%&gt;
  &lt;%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags"%&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
          &lt;link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/bootstrap.min.css"&gt;
          &lt;script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"&gt;&lt;/script&gt;
          &lt;script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js"&gt;&lt;/script&gt;
          &lt;link href="../css/style.css" rel="stylesheet" type="text/css"&gt;
          &lt;style&gt;&lt;%@include file="/css/style.css"%&gt;&lt;/style&gt;
          &lt;title&gt;Все студенты&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
              &lt;br&gt;
              &lt;br&gt;
              &lt;br&gt;
              &lt;br&gt;
              &lt;div class="it"&gt;
                  &lt;h3&gt;Список всех студентов&lt;/h3&gt;
                  ${message}
  
                  &lt;br&gt;
                  &lt;br&gt;
                  &lt;table class="table"&gt;
                      &lt;thead&gt;
                          &lt;tr&gt;
                              &lt;th scope="col"&gt;#&lt;/th&gt;
                              &lt;th scope="col"&gt;Name&lt;/th&gt;
  
                              &lt;th scope="col"&gt;Surname&lt;/th&gt;
                              &lt;th scope="col"&gt;Avatar&lt;/th&gt;
                          &lt;/tr&gt;
                      &lt;/thead&gt;
                      &lt;tbody&gt;
                          &lt;c:forEach var="student" items="${studentList}"&gt;
                              &lt;tr&gt;
                                  &lt;th scope="row"&gt;1&lt;/th&gt;
                                  &lt;td&gt;${student.name}&lt;/td&gt;
                                  &lt;td&gt;${student.surname}&lt;/td&gt;
  
                                  &lt;td&gt;&lt;img src="${pageContext.request.contextPath}/avatar?avatar=${student.avatar}" style="max-height: 200px; max-width: 200px;" /&gt;&lt;/td&gt;
  
                                  &lt;td&gt;
                                      &lt;sec:authorize access="hasRole('ADMIN')"&gt;
                                          &lt;a href="${pageContext.request.contextPath}/editStudent/${student.id}"&gt;
                                              &lt;button type="button" class="btn btn-primary"&gt;Edit&lt;/button&gt;
                                          &lt;/a&gt;
                                      &lt;/sec:authorize&gt;
                                  &lt;/td&gt;
                                  &lt;td&gt;
                                      &lt;sec:authorize access="hasRole('ADMIN')"&gt;
                                          &lt;a href="${pageContext.request.contextPath}/deleteStudent/${student.id}"&gt;
                                              &lt;button type="button" class="btn btn-primary"&gt;Delete&lt;/button&gt;
                                          &lt;/a&gt;
                                      &lt;/sec:authorize&gt;
                                  &lt;/td&gt;
                              &lt;/tr&gt;
                          &lt;/c:forEach&gt;
                      &lt;/tbody&gt;
                  &lt;/table&gt;
  
              &lt;/div&gt;
  
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>AllStudentsUser.jsp (For User)</p>
  
  <pre><code>&lt;%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" isELIgnored="false"%&gt;
  &lt;%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%&gt;
  &lt;%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags"%&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
          &lt;link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/bootstrap.min.css"&gt;
          &lt;script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"&gt;&lt;/script&gt;
          &lt;script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js"&gt;&lt;/script&gt;
          &lt;link href="../css/style.css" rel="stylesheet" type="text/css"&gt;
          &lt;style&gt;&lt;%@include file="/css/style.css"%&gt;&lt;/style&gt;
          &lt;title&gt;Все студенты&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
              &lt;br&gt;
              &lt;br&gt;
              &lt;br&gt;
              &lt;br&gt;
              &lt;div class="it"&gt;
                  &lt;h3&gt;Список всех студентов&lt;/h3&gt;
                  ${message}
  
                  &lt;br&gt;
                  &lt;br&gt;
                  &lt;table class="table"&gt;
                      &lt;thead&gt;
                          &lt;tr&gt;
                              &lt;th scope="col"&gt;#&lt;/th&gt;
                              &lt;th scope="col"&gt;Name&lt;/th&gt;
  
                              &lt;th scope="col"&gt;Surname&lt;/th&gt;
                              &lt;th scope="col"&gt;Avatar&lt;/th&gt;
                          &lt;/tr&gt;
                      &lt;/thead&gt;
                      &lt;tbody&gt;
                          &lt;c:forEach var="student" items="${studentList}"&gt;
                              &lt;tr&gt;
                                  &lt;th scope="row"&gt;1&lt;/th&gt;
                                  &lt;td&gt;${student.name}&lt;/td&gt;
                                  &lt;td&gt;${student.surname}&lt;/td&gt;
  
                                  &lt;td&gt;&lt;img src="${pageContext.request.contextPath}/avatar?avatar=${student.avatar}" style="max-height: 200px; max-width: 200px;" /&gt;&lt;/td&gt;
  
  
                              &lt;/tr&gt;
                          &lt;/c:forEach&gt;
                      &lt;/tbody&gt;
                  &lt;/table&gt;
  
              &lt;/div&gt;
  
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Student Controller (add Secured)</p>
  
  <pre><code> @RequestMapping(value = "/allStudents",  method = {RequestMethod.GET, RequestMethod.POST})
  
      public ModelAndView displayAllUser() {
          System.out.println("User Page Requested : All Students");
          ModelAndView mv = new ModelAndView();
          List&lt;Student&gt; studentList = studentService.getAllStudents();
          mv.addObject("studentList", studentList);
          mv.setViewName("allStudents");
          return mv;
      }
  
       @Secured("ROLE_ADMIN")
      @RequestMapping(value = "/allStudentsAdmin",  method = {RequestMethod.GET, RequestMethod.POST})
  
      public ModelAndView displayAllUsers() {
          System.out.println("User Page Requested : All Students");
          ModelAndView mv = new ModelAndView();
          List&lt;Student&gt; studentList = studentService.getAllStudents();
          mv.addObject("studentList", studentList);
          mv.setViewName("allStudentsUser");
          return mv;
      }
  
  
  
      @Secured("ROLE_USER")
      @RequestMapping(value = "/allStudentsUser",  method = {RequestMethod.GET, RequestMethod.POST})
  
      public ModelAndView displayAllUsers() {
          System.out.println("User Page Requested : All Students");
          ModelAndView mv = new ModelAndView();
          List&lt;Student&gt; studentList = studentService.getAllStudents();
          mv.addObject("studentList", studentList);
          mv.setViewName("allStudentsUser");
          return mv;
      }
  </code></pre>