# Why intercept secure urls inside application

**URL:** https://forum.keycloak.org/t/why-intercept-secure-urls-inside-application/1126
**Category:** Getting advice
**Created:** [January 31, 2020, 1:32pm UTC](https://forum.keycloak.org/t/why-intercept-secure-urls-inside-application/1126 "2020-01-31T13:32:53Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![gpareek](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/gpareek/32/322_2.png) [@gpareek](https://forum.keycloak.org/u/gpareek)
#### Post date: [January 31, 2020, 1:32pm UTC](https://forum.keycloak.org/t/why-intercept-secure-urls-inside-application/1126/1 "2020-01-31T13:32:53Z")

</div>

I am referring to the app-authz-spring-security quickstart to integrate spring application with Keycloak for authentication & authorisation. For authorisation, we prefer to completely maintain resources, policies & permissions in keycloak. However, we noticed that we are also forced to maintain the secured urls along with the desired role on the application side. Like below.  
Is there a reason why we have to do this and cannot completely manage resources permissions in Keycloak? This puts some restrictions, like in keycloak, at runtime, I cannot allow admins to access account pages. For that, I will have to change this code.

> ```
> protected void configure(HttpSecurity http) throws Exception {
> super.configure(http);
> http.logout().logoutSuccessUrl("/home")
> .and()
> .authorizeRequests()
> .antMatchers("/account/**").hasAuthority("user")
> .antMatchers("/company/**").hasAuthority("admin");
> }
> 
> ```