I’m migrating a simple JSF app to a higher version of Spring Security. App contains two pages – login and main page, which is accesible to a few in-memory users. Initially I was using Spring 3.2.9.RELEASE and Spring Security 3.2.5.RELEASE.

Configuration class:

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    // @formatter:off
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user1").password("<pass1>").authorities("isAuthenticated()")
                               .and().withUser("user2").password("<pass2>").authorities("isAuthenticated()")
                               .and().withUser("user3").password("<pass3>").authorities("isAuthenticated()");
    }
    // @formatter:on

    // @formatter:off
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .disable()
            .authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/pages/login**").permitAll()
                .antMatchers("/pages/main**").authenticated()
                .and()
            .formLogin()
                .loginPage("/pages/login.jsf").permitAll()
                .defaultSuccessUrl("/pages/main.jsf")
                .usernameParameter("username")
                .passwordParameter("password")
                .failureUrl("/pages/login.jsf?error=403")
                .and()
            .logout()
                .logoutSuccessUrl("/pages/login.jsf")
                .logoutUrl("/j_spring_security_logout");        
    }
    // @formatter:on
}

After upgrading Spring version to 6.1.6 and Spring Security version 6.2.4, my config class changed a bit:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;

@Configuration
@EnableWebSecurity
@EnableWebMvc
public class SecurityConfig {
    @Bean
    public UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.builder().username("user1").password("<pass1>").authorities("isAuthenticated()").build());
        manager.createUser(User.builder().username("user2").password("<pass2>").authorities("isAuthenticated()").build());
        manager.createUser(User.builder().username("user3").password("<pass3>").authorities("isAuthenticated()").build());
        return manager;
    }

    // @formatter:off
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
        MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector).servletPath("/MetaProject");
        http
                .csrf((csrf) -> csrf
                        .disable())
                .authorizeHttpRequests((authz) -> authz
                        .requestMatchers(mvcMatcherBuilder.pattern("/")).permitAll()
                        .requestMatchers(mvcMatcherBuilder.pattern("/pages/login**")).permitAll()
                        .requestMatchers(mvcMatcherBuilder.pattern("/pages/main**")).authenticated()
                )
                .formLogin((form) -> form
                        .loginPage("/pages/login.jsf").permitAll()
                        .defaultSuccessUrl("/pages/main.jsf")
                        .usernameParameter("username")
                        .passwordParameter("password")
                        .failureUrl("/pages/login.jsf?error=403")
                )
                .logout((logout) -> logout
                        .logoutUrl("/j_spring_security_logout")
                        .logoutSuccessUrl("/pages/login.jsf")
                );
        return http.build();
    }
    // @formatter:on
}

When upgrading String version, I also changed project structure to a “Maven-like”.

Now I have a problem with static resources, it seems that Spring Security is blocking them.

Those resources are located in src/main/webapp/resources. I’ve tried to add some request matcher in config class to match those resources, but no luck.

.requestMatchers(new AntPathRequestMatcher("/resources/**")).permitAll()

What am I missing here?