web/src/main/java/org/springframework/security/web/access/DefaultWebInvocationPrivilegeEvaluator.java
public boolean isAllowed(String contextPath, String uri, String method,
			Authentication authentication) {
		Assert.notNull(uri, "uri parameter is required");

		FilterInvocation fi = new FilterInvocation(contextPath, uri, method);
		Collection<ConfigAttribute> attrs = securityInterceptor
				.obtainSecurityMetadataSource().getAttributes(fi);

		if (attrs == null) {
			if (securityInterceptor.isRejectPublicInvocations()) {
				return false;
			}

			return true;
		}

		if (authentication == null) {
			return false;
		}

		try {
			securityInterceptor.getAccessDecisionManager().decide(authentication, fi,
					attrs);
		}
		catch (AccessDeniedException unauthorized) {
			if (logger.isDebugEnabled()) {
				logger.debug(fi.toString() + " denied for " + authentication.toString(),
						unauthorized);
			}

			return false;
		}

		return true;
	}
public boolean isAllowed(String contextPath, String uri, String method,
			Authentication authentication) {
		Assert.notNull(uri, "uri parameter is required");

		FilterInvocation fi = new FilterInvocation(contextPath, uri, method);
		Collection<ConfigAttribute> attrs = securityInterceptor
				.obtainSecurityMetadataSource().getAttributes(fi);

		if (attrs == null) {
			if (securityInterceptor.isRejectPublicInvocations()) {
				return false;
			}

			return true;
		}

		if (authentication == null) {
			return false;
		}

		try {
			securityInterceptor.getAccessDecisionManager().decide(authentication, fi,
					attrs);
		}
		catch (AccessDeniedException unauthorized) {
			if (logger.isDebugEnabled()) {
				logger.debug(fi.toString() + " denied for " + authentication.toString(),
						unauthorized);
			}

			return false;
		}

		return true;
	}
public boolean isAllowed ( String contextPath , String uri , String method , Authentication authentication ) { Assert . notNull ( uri , "uri parameter is required" ) ; FilterInvocation fi = new FilterInvocation ( contextPath , uri , method ) ; Collection < ConfigAttribute > attrs = securityInterceptor . obtainSecurityMetadataSource ( ) . getAttributes ( fi ) ; if ( attrs == null ) { if ( securityInterceptor . isRejectPublicInvocations ( ) ) { return false ; } return true ; } if ( authentication == null ) { return false ; } try { securityInterceptor . getAccessDecisionManager ( ) . decide ( authentication , fi , attrs ) ; } catch ( AccessDeniedException unauthorized ) { if ( logger . isDebugEnabled ( ) ) { logger . debug ( fi . toString ( ) + " denied for " + authentication . toString ( ) , unauthorized ) ; } return false ; } return true ; }
Determines whether the user represented by the supplied <tt>Authentication</tt>
object is allowed to invoke the supplied URI, with the given .
<p>
Note the default implementation of <tt>FilterInvocationSecurityMetadataSource</tt>
disregards the <code>contextPath</code> when evaluating which secure object
metadata applies to a given request URI, so generally the <code>contextPath</code>
is unimportant unless you are using a custom
<code>FilterInvocationSecurityMetadataSource</code>.

@param uri the URI excluding the context path
@param contextPath the context path (may be null, in which case a default value
will be used).
@param method the HTTP method (or null, for any method)
@param authentication the <tt>Authentication</tt> instance whose authorities should
be used in evaluation whether access should be granted.
@return true if access is allowed, false if denied
Determines whether the user represented by the supplied <tt > Authentication< / tt > object is allowed to invoke the supplied URI with the given . <p > Note the default implementation of <tt > FilterInvocationSecurityMetadataSource< / tt > disregards the <code > contextPath< / code > when evaluating which secure object metadata applies to a given request URI so generally the <code > contextPath< / code > is unimportant unless you are using a custom <code > FilterInvocationSecurityMetadataSource< / code > .