带有Spring Boot的Spring Security 4：静态资源（即CSS，JS，IMG）404问题

Question

I'm using Spring Boot with Spring Security to create a web app with SSL enabled (manually created SSL files). Everything is working fine, however, whenever I'm trying to access any static resources like css or js files, it's unable to find those files and also showing following error:

The resource from “ https://localhost:8443/css/lib/index.css ” was blocked due to MIME type mismatch (X-Content-Type-Options: nosniff).

It's happening not only for the login page but also for other pages too. After successfull login also I'm getting this error.

Below is my security config:

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .antMatchers("/css/**"/*, "/js/**", "/img/**", "/error"*/).permitAll()
            .anyRequest().fullyAuthenticated()
        .and()
            .formLogin()
            .loginPage("/login").permitAll()
            .defaultSuccessUrl("/home", true)
            .successHandler(authSuccessHandler)
        .and()
            .headers()
            .frameOptions().sameOrigin()
            .httpStrictTransportSecurity().disable()
        .and()
            .logout().addLogoutHandler(new LogoutHandler() {
                @Override
                public void logout(HttpServletRequest request,HttpServletResponse response, Authentication authentication) {
                    request.getSession().invalidate();                  
                }
            })
            .logoutUrl("/logout").permitAll().logoutSuccessUrl("/login")
            .invalidateHttpSession(true).logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
            .deleteCookies("JSESSIONID")
        .and()
            .sessionManagement().maximumSessions(1);
    }

css files are placed in the following path:

src/main/resources/public/css/lib/index.csss

I'm using Freemarker, and below is how I'm calling this css file:

<link rel="stylesheet" href="/css/lib/index.css" type="text/css" media="screen" charset="utf-8"/>

What I'm doing wrong in here?

Answer 1

If you are not using Boot for AutoConfiguration of WebMvc and have a configuration class that has annotation @EnableWebMvc that extends WebMvcConfigurerAdapter

Then override the following method, it adds the required location for /public/**

@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
    registry.addResourceHandler("/public/**")
        .addResourceLocations("/public/");

And in the Security Configuration file , add following :

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/public/**");
}
}

This will ensure that /public/** is excluded from security preview

Answer 2

Try to ignore and exclude these resources from processing at all:

@Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring().antMatchers("/css/**","/js/**","/img/**","/error/**");
        }