Here is a part from Spring Security petclinic example:
The difference is that filters = "none"
disables Spring Security filters for the specified URLs, whereas access = "permitAll"
configures authorization without disabling filters.
In practice, filters = "none"
may cause problems when resources behind it require some functionality of Spring Security. For example, you can't use it for user registration page that performs programmatic login on submit (User Granted Authorities are always : ROLE_ANONYMOUS?).