My question is, why does spring show me the login page first even though I specified that all pages should be denied in my spring security settings? It is true that authentication is done first and then authorization, but in this particular case, there is no need to identify the user, and no one is supposed to be allowed access to the entire web application.
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.anyRequest()
.denyAll()
.and()
.formLogin()
.and()
.httpBasic();
}
}