java - How can I allow GET requests without authentication but secure other HTTP methods? -

i've created webservice spring roo , added spring security project. works fine far want allow access entities information via http requests without authentication. other http methods post, put etc. should stay secure.

my applicationcontext-security.xml looks following when http on "/releaseupdates/" "accept: application/json" header returns login page (i think spring security redirects login page internally):

 <http auto-config="true" use-expressions="true">         <form-login login-processing-url="/resources/j_spring_security_check" login-page="/login" authentication-failure-url="/login?login_error=t" />         <logout logout-url="/resources/j_spring_security_logout" />         <!-- configure these elements secure uris in application -->         <intercept-url pattern="/releaseupdates/**" access="permitall" method="get" />         <intercept-url pattern="/releaseupdates/**" access="hasrole('role_admin')" method="post" />         <intercept-url pattern="/releaseupdatestatuses/**" access="hasrole('role_admin')"/>         <intercept-url pattern="/choices/**" access="hasrole('role_admin')" />         <intercept-url pattern="/member/**" access="isauthenticated()" />         <intercept-url pattern="/resources/**" access="permitall" />         <intercept-url pattern="/login/**" access="permitall" />         <intercept-url pattern="/**" access="isauthenticated()" /> </http> 

there annotation @preauthorize friend here. annotation @ class or method level on controllers.

here's example:

@controller @requestmapping("/releaseupdates") public class releaseupdatecontroller {     @requestmapping(method=requestmethod.get)    public string unprotectedgetrequest() {       //do something, no protection    }     @preauthorize("hasrole('role_admin')")    @requestmapping(method=requestmethod.post)    public string securepostrequest() {       //do something, secured    }  }