favicon displayed only when user is connected

user_1095362 0
Viewed 53

I use spring boot 2.6.7 with spring security and thymeleaf

I put my favicon in

resources/static/

I see only the icon when the user is connected

I added this code to permit all

@Override
public void configure(HttpSecurity httpSecurity) throws Exception {
    httpSecurity.authorizeRequests()
            .antMatchers(HttpMethod.POST, "/printdownload**").permitAll()
            .antMatchers(
                    "/",
                    "/help**",
                    "/css/**",
                    "/js/**",
                    "**/favicon.ico",
                    "/img/**").permitAll()

            .anyRequest().authenticated()
            .and()
            .formLogin().loginPage("/login").permitAll()
            .successHandler(customAuthenticationSuccessHandler)
            .and()
            .logout();

}

@Override
public void configure(WebSecurity web) {
    web.ignoring().antMatchers("/css/**", "/js/**", "/img/**", "**/favicon.ico");
}

But get same result.

If i try to display: http://localhost:8080/favicon.ico that return me to the login page

spring-boot spring-security
1 Answers

You need to use /**/favicon.ico instead of **/favicon.ico.

According to the Javadoc of Spring's AntPathMatcher:

A pattern and a path must both be absolute or must both be relative in order for the two to match. Therefore it is recommended that users of this implementation to sanitize patterns in order to prefix them with "/" as it makes sense in the context in which they're used.

That you can use ** as short-cut for /** to match all requests is a special case. It doesn't work if ** is used at the beginning of a pattern.

user_154969650
Related