Now, let's see how Spring Security will work when we try to access a protected resource, in our case, the home page at /.

After you open http://localhost:8080 and the page finishes loading, you can see that you have actually landed on the login page at /login. Let's check the debug log information to see what Spring Security did exactly. As you can see from the log, everything Spring Security did this time is the same as the last time when we tried to access a public resource, except what happened at the last filter, FilterSecurityInterceptor. The following is the log printed out when the request was processed by this filter:

AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@93d13c0, returned: -1
ExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
  at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84)
...

As you can see, DecisionManager has denied access based on the voter's result. It threw AccessDeniedException, which is caught by ExceptionTranslationFilter. Since it is an anonymous user, redirection to the login page occurred.