Spring security does not allow CSS or JS resources to be loaded

Question

The resource is under src/main/resources/static/css or src/main/resources/static/js, I'm using spring boot, and the class of security is:

@Configuration
@EnableWebMvcSecurity
@EnableGlobalAuthentication
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
//      http.authorizeRequests().antMatchers("/", "/index", "/quizStart")
//              .permitAll().anyRequest().authenticated();
//      http.formLogin().loginPage("/login").permitAll().and().logout()
//              .permitAll();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth)
            throws Exception {
        auth.inMemoryAuthentication().withUser("test").password("test")
                .roles("USER");
    }
}

It works well (resources can be loaded) when I access "/index" from browser, however, if I uncomment the four lines in the class, resources can not be loaded, the four lines means:

    http.authorizeRequests().antMatchers("/", "/index", "/quizStart")
            .permitAll().anyRequest().authenticated();
    http.formLogin().loginPage("/login").permitAll().and().logout()
            .permitAll();

Could anyone help with this ? Thanks in advance.

score 38 · Accepted Answer · answered Aug 18 '14 at 17:15

38

You probably want to make sure to have your directory containing those items set as permitAll.

Here's an excerpt from my spring security context file. Under the resources directory, I have js, css, and images folders which are given permissions by this line.

<security:intercept-url pattern="/resources/**" access="permitAll" />

answered Aug 18 '14 at 17:15

John Humphreys

37,047
37
155
255

25

thanks for your notification, I add line `http.authorizeRequests().antMatchers("/css/**", "/js/**", "/images/**").permitAll();` into `protected void configure(HttpSecurity http)` and then it works, thanks a lot. – Junjie Aug 18 '14 at 17:32
1

No problem. I used a pretty sweet maven archetype I found online to generate this project, and it started out with a working, spring MVC, spring security, JPA, and thymeleaf project. It's got a very good spring java config setup by default, you might want to check it out: https://github.com/kolorobot/spring-mvc-quickstart-archetype. – John Humphreys Aug 18 '14 at 17:46
It's really good to me and I have join the watched list, will have a try later, thanks again~ – Junjie Aug 18 '14 at 17:53
Where should this file be located? Any examples? – Martin Erlic Feb 06 '17 at 17:03
1

Spring Boot will, by default, permit access to `/css/**`, `/js/**`, `/images/**`, and `/**/favicon.ico`. – Shubham A. Apr 04 '17 at 14:59
@Junjie Thanks a lot bro! :D – Skizo-ozᴉʞS ツ Nov 24 '17 at 12:03

score 18 · Answer 2 · answered Aug 14 '16 at 13:21

18

For some reason, this did not work for me:

http.authorizeRequests().antMatchers("/resources/**").permitAll();

I had to add this:

http.authorizeRequests().antMatchers("/resources/**").permitAll().anyRequest().permitAll();

Also, this line has to be after the code which restrics access.

answered Aug 14 '16 at 13:21

Str

213
2
3

7

In this way you removed all security, the '.anyRequest().permitAll()' will permit all requests, you must find the right path to your resources and use it. If you use spring security, then usually anyRequest() has to be authenticated() – Frighi Feb 08 '19 at 11:06
you might as well not even do the first antmatcher then lol – Braden Borman Jun 20 '22 at 17:17

score 13 · Answer 3 · answered Jun 28 '17 at 12:10

13

Add following

@Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/resources/**").anyRequest();
    }

answered Jun 28 '17 at 12:10

Yogesh Bombe

325
3
18

1

.anyRequest(); will block your site – underwater ranged weapon Dec 01 '17 at 11:43
@Yogesh : Worked..Kudos, that's exactly the issue which I was having. Thanks again. – Soham Feb 02 '18 at 17:08

score 11 · Answer 4 · answered Mar 20 '18 at 09:50

you can also use directly like "/*.js" for specific file or "/resources/**" for directory

 http.authorizeRequests()
                .antMatchers("/", "/login", "/logout", "/error").permitAll()
                .antMatchers("/resources/**").permitAll()
                .antMatchers("/*.js").permitAll()
                .antMatchers("/api/**").authenticated()

score 10 · Answer 5 · answered Mar 10 '20 at 19:01

I had the same problem and the permitAll() solution didn't work for me. I added the following @Overridemethod to my WebSecurityConfigclass.

@Override
public void configure(WebSecurity web) throws Exception {
    web
            .ignoring()
            .antMatchers("/resources/**", "/static/**", "/css/**", "/js/**", "/img/**", "/icon/**");
}

Good Luck!

score 0 · Answer 6 · answered Mar 01 '16 at 16:21

I had the same problem and changing access to "permitAll" didn't help. I created a new http pattern where I set security to "none" and then I was able to download the css and js files without authentication.

<http pattern="/resources/**" security="none" />

score 0 · Answer 7 · answered May 02 '17 at 21:47

This finally worked for me. The /home (which will bring up the login page) and error messages do not need authentication. All the resources are permitAll, and the /main url is authenticated. Any other url (eg. /users /customers etc..) would need to be added as isAuthenticated()

  <security:intercept-url pattern="/home" access="isAnonymous()"/>
  <security:intercept-url pattern="/error*" access="isAnonymous()"/>      
  <security:intercept-url pattern="/main" access="isAuthenticated()"/>
  <security:intercept-url pattern="/css/**" access="permitAll" />     
  <security:intercept-url pattern="/js/**" access="permitAll" />
  <security:intercept-url pattern="/fonts/**" access="permitAll" />
  <security:intercept-url pattern="/images/**" access="permitAll" />

score 0 · Answer 8 · answered Jun 20 '22 at 17:20

0

.antMatchers("/.js", "/.css").permitAll()

answered Jun 20 '22 at 17:20

Braden Borman

309
1
8

Spring security does not allow CSS or JS resources to be loaded

8 Answers8

Linked