add possible trailing slash to the end of the regex
<sec:xss-protection />
</sec:headers>
<sec:intercept-url pattern="/(resource|data|page)(/need(/?))?" access="permitAll"/>
- <sec:intercept-url pattern="/(resource|data|page)/((need/[a-zA-Z0-9]+(/connections(/?))?)|(connection/a-zA-Z0-9]+(/events)?))" access="permitAll"/>
+ <sec:intercept-url pattern="/(resource|data|page)/((need/[a-zA-Z0-9]+(/connections)?)|(connection/a-zA-Z0-9]+))(/?)" access="permitAll"/>
<sec:intercept-url pattern=".*" access="denyAll"/>
<!-- we do not need CSRF protection for publicly accessible resources, as accessing them is not state-changing -->
<sec:csrf disabled="true" />
