spring security login page does not load resources

Question

I have a problem with my web application done with spring security, it has a login page:

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<%@ taglib prefix = "form" uri = "http://www.springframework.org/tags/form"%>
<%@ page isELIgnored="false"%>
........

    
    
    
    
    





    
        Errore nel login controllare username / password
    
    
        
            
                " method="post">
                    
                    
                    

                    
                        
                    
                    
                        
                    
                    
                        
                            Hai dimenticato la password?

                            Clicca qui

and my configuration class that permits loading url and forwardin to login page is:

@Configuration
@EnableWebSecurity
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private DataSource dataSource;

    @Autowired
    public void configAuthentication(AuthenticationManagerBuilder authBuilder) throws Exception {
        authBuilder
                .jdbcAuthentication()
                .dataSource(dataSource)
                .usersByUsernameQuery("SELECT username, password, enabled FROM Utenti WHERE username = ?")
                .authoritiesByUsernameQuery("SELECT username, role FROM Utenti WHERE username = ?");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf()
                .disable()
                .authorizeRequests().anyRequest().hasAnyRole("USER","ADMIN")
                .and()
                .authorizeRequests().antMatchers("/login**").permitAll()
                .and()
                .authorizeRequests().antMatchers("/resource**").permitAll()
                .and()
                .formLogin()
                .loginPage("/login")
                .loginProcessingUrl("/performlogin")
                .usernameParameter("username")
                .passwordParameter("password")
                .defaultSuccessUrl("/home", true)
                .failureUrl("/login?error=true")
                .permitAll()
                .and()
                .logout()
                .logoutUrl("/perform_logout")
                .deleteCookies("JSESSIONID")
                .permitAll();

    }
}

but when loaded the login page it does not load all the css, javascript and images. for the other pages displayed after the login the resources are loaded correctly. The resources are all put in place under the resources folder under src/main/java of my maven project.

What could be the problem?

Thanks

user_15835039 · Answer

Try removing the multiple .authorizeRequests()...and() and condense to:

.authorizeRequests(authorize -> authorize
  .antMatchers("/login**", "/resource**").permitAll()
  .anyRequest().hasAnyRole("USER","ADMIN")
}
...

Order does matter. Also, you don't want to call .authorizeRequests() multiple times.

You can read more on the latest way to do this (via .authorizeHttpRequests() which uses the new AuthorizationFilter in 5.5) here: Authorize HttpServletRequests with AuthorizationFilter.

If that doesn't work, feel free to update the question and we can see if something else is going on.

user_13668285 · Answer

I solved changing the authorize like this:

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        String[] staticResources  =  {
                "/css/**",
                "/scripts/**",
                "/resource/images/images-logo-softpulizie.png"
        };

        http.csrf()
                .disable()
                .authorizeRequests()
                .antMatchers(staticResources).permitAll()
                .antMatchers("/login**").permitAll()
                .antMatchers("/performlogin")
                .hasAnyRole("USER", "ADMIN")
                .and()
                .formLogin()
                .loginPage("/login")
                .loginProcessingUrl("/performlogin")
                .usernameParameter("username")
                .passwordParameter("password")
                .defaultSuccessUrl("/home", true)
                .failureUrl("/login?error=true")
                .permitAll()
                .and()
                .logout()
                .logoutUrl("/perform_logout")
                .deleteCookies("JSESSIONID")
                .permitAll();

    }

spring security login page does not load resources

2 Answers