removed s from connections in intercept url pattern (was faulty) and added permission for everyone to see connections of need
verification step is not needed, and we can be more open about caching.
-->
<sec:http request-matcher="regex"
- pattern="/(resource|data|page)/((event/.+)|(need/[a-zA-Z0-9]+/((deep.*)|(events/.+)))|(connections/[a-zA-Z0-9]+/events.*deep=true.*))"
+ pattern="/(resource|data|page)/((event/.+)|(need/[a-zA-Z0-9]+/((deep.*)|(events/.+)))|(connection/[a-zA-Z0-9]+/events.*deep=true.*))"
entry-point-ref="authorizationEntryPoint"
authentication-manager-ref="clientCertificateWebIdAuthenticationManager"
access-decision-manager-ref="webIdBasedAccessDecisionManager">
<sec:xss-protection />
</sec:headers>
<sec:intercept-url pattern="/(resource|data|page)(/need(/?))?" access="permitAll"/>
- <sec:intercept-url pattern="/(resource|data|page)/((need/[a-zA-Z0-9]+)|(connection/a-zA-Z0-9]+(/events)?))" access="permitAll"/>
+ <sec:intercept-url pattern="/(resource|data|page)/((need/[a-zA-Z0-9]+(/connections(/?)?))|(connection/a-zA-Z0-9]+(/events)?))" access="permitAll"/>
<sec:intercept-url pattern=".*" access="denyAll"/>
<!-- we do not need CSRF protection for publicly accessible resources, as accessing them is not state-changing -->
<sec:csrf disabled="true" />
