I intentionally set the http tag in my applicationContext-security.xml to permit all request url as follow:

    <global-method-security pre-post-annotations="enabled">     
        </global-method-security> 
    <http auto-config="true" use-expressions="true">        
            <intercept-url pattern="/**" access="permitAll" />      
            <custom-filter position="PRE_AUTH_FILTER" ref="webSEALFilter" />
            <custom-filter after="PRE_AUTH_FILTER" ref="myFilter"/>     
            <access-denied-handler error-page="/error/abc"/>
            <logout invalidate-session="true" logout-success-url="/" logout-url="/logout"/>  
            <session-management invalid-session-url="${${ENV}.login.url}">
                <concurrency-control expired-url="${${ENV}.login.url}" />
            </session-management>
        </http>
        
<beans:bean id="webSecurityExpressionHandler" 
        class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler" />
        

but still for the request

/SLIS/WEB-INF/view/homeMessage.jsp

it still go to access-denied-handler as found in console message

[org.springframework.web.servlet.PageNotFound] (default task-3) No mapping for POST >/SLIS/error/abc
[org.springframework.web.servlet.PageNotFound] (default task-3) No endpoint POST /SLIS/error/abc.

why?
I use spring security 6.2.4