I have a question about Spring Security (I’m using Spring Security 6 for currently).

What happens if no existing request URI?

Exam, I have the configuration like this:

@Bean
    SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
        http
                .csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests(
                        requests -> requests
                                .requestMatchers(RequestURI.PUBLIC_UNAUTHENTICATION_URI).permitAll()
                                .anyRequest().authenticated()
                )
                .formLogin( form -> form
                        .loginPage("/login")
                        .defaultSuccessUrl("/welcome")
                        .permitAll())
                .logout( logout -> logout
                        .logoutSuccessUrl("/login")
                        .invalidateHttpSession(true)
                        .logoutRequestMatcher(new AntPathRequestMatcher("/logout", "GET"))
                        .permitAll());

        return http.build();
    }

I don’t create any controller with URI ‘/login’. So what will happen?

Actually, I had tested and get result ‘redirected too many times’. Explaining for this problem that Spring Security not found ‘/login’ URI, mean this URI unauthenticated -> redirect ‘/login’ to authenticate -> recursive loop.

Because ‘/login’ URI has been permit, so if ‘/login’ URI not exist, it should be return 404.

SOmeone please can explain for me?

tried many times but not understanding much