Securing static resources in a Spring Boot App
up vote
0
down vote
favorite
I want to secure all content in the 'static' folder of a Spring Boot app.
I have tried all sorts of combinations in my security config including:
.antMatchers("/resources/**").authenticated()
.antMatchers("/resources/static/**").authenticated()
.antMatchers("/static/**").authenticated()
None of these work. What is the correct way to do this?
spring-boot spring-security
asked Nov 21 at 14:24
SME
529
add a comment |
up vote
0
down vote
favorite
I want to secure all content in the 'static' folder of a Spring Boot app.
I have tried all sorts of combinations in my security config including:
.antMatchers("/resources/**").authenticated()
.antMatchers("/resources/static/**").authenticated()
.antMatchers("/static/**").authenticated()
None of these work. What is the correct way to do this?
spring-boot spring-security
asked Nov 21 at 14:24
SME
529
Those folders are served, but they're not actually within the path of any web request, so they don't match to anything. A proper solution would be to put your static resources within folders, eg.src/main/resources/static/css/mystyle.cssand to add matchers to those, eg..antMatchers("/css/**").authenticated().
– g00glen00b
Nov 21 at 14:27
Thanks but, I have tried that and it doesn't work.
– SME
Nov 21 at 14:52
1
I'm using Spring Boot 1.5.1.RELEASE and my static resources are in src/main/resources/static. I want to prevent unauthorized users downloading certain javascript files.
– SME
Nov 21 at 15:33
Show your complete configuration class with all anotations.
– dur
Nov 22 at 21:24
It's ok. I have a work around. I created a folder call app-js and moved all the JavaScript I wanted to secure into this folder and that works.
– SME
Nov 22 at 22:15
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I want to secure all content in the 'static' folder of a Spring Boot app.
I have tried all sorts of combinations in my security config including:
.antMatchers("/resources/**").authenticated()
.antMatchers("/resources/static/**").authenticated()
.antMatchers("/static/**").authenticated()
None of these work. What is the correct way to do this?
spring-boot spring-security
asked Nov 21 at 14:24
SME
529
I want to secure all content in the 'static' folder of a Spring Boot app.
I have tried all sorts of combinations in my security config including:
.antMatchers("/resources/**").authenticated()
.antMatchers("/resources/static/**").authenticated()
.antMatchers("/static/**").authenticated()
None of these work. What is the correct way to do this?
spring-boot spring-security
spring-boot spring-security
asked Nov 21 at 14:24
SME
529
asked Nov 21 at 14:24
SME
529
asked Nov 21 at 14:24
SME
529
asked Nov 21 at 14:24
SME
529
asked Nov 21 at 14:24
SME
529
529
Those folders are served, but they're not actually within the path of any web request, so they don't match to anything. A proper solution would be to put your static resources within folders, eg.src/main/resources/static/css/mystyle.cssand to add matchers to those, eg..antMatchers("/css/**").authenticated().
– g00glen00b
Nov 21 at 14:27
Thanks but, I have tried that and it doesn't work.
– SME
Nov 21 at 14:52
1
I'm using Spring Boot 1.5.1.RELEASE and my static resources are in src/main/resources/static. I want to prevent unauthorized users downloading certain javascript files.
– SME
Nov 21 at 15:33
Show your complete configuration class with all anotations.
– dur
Nov 22 at 21:24
It's ok. I have a work around. I created a folder call app-js and moved all the JavaScript I wanted to secure into this folder and that works.
– SME
Nov 22 at 22:15
add a comment |
Those folders are served, but they're not actually within the path of any web request, so they don't match to anything. A proper solution would be to put your static resources within folders, eg.src/main/resources/static/css/mystyle.cssand to add matchers to those, eg..antMatchers("/css/**").authenticated().
– g00glen00b
Nov 21 at 14:27
Thanks but, I have tried that and it doesn't work.
– SME
Nov 21 at 14:52
1
I'm using Spring Boot 1.5.1.RELEASE and my static resources are in src/main/resources/static. I want to prevent unauthorized users downloading certain javascript files.
– SME
Nov 21 at 15:33
Show your complete configuration class with all anotations.
– dur
Nov 22 at 21:24
It's ok. I have a work around. I created a folder call app-js and moved all the JavaScript I wanted to secure into this folder and that works.
– SME
Nov 22 at 22:15
Those folders are served, but they're not actually within the path of any web request, so they don't match to anything. A proper solution would be to put your static resources within folders, eg.
src/main/resources/static/css/mystyle.css and to add matchers to those, eg. .antMatchers("/css/**").authenticated().– g00glen00b
Nov 21 at 14:27
Those folders are served, but they're not actually within the path of any web request, so they don't match to anything. A proper solution would be to put your static resources within folders, eg.
src/main/resources/static/css/mystyle.css and to add matchers to those, eg. .antMatchers("/css/**").authenticated().– g00glen00b
Nov 21 at 14:27
Thanks but, I have tried that and it doesn't work.
– SME
Nov 21 at 14:52
Thanks but, I have tried that and it doesn't work.
– SME
Nov 21 at 14:52
1
1
I'm using Spring Boot 1.5.1.RELEASE and my static resources are in src/main/resources/static. I want to prevent unauthorized users downloading certain javascript files.
– SME
Nov 21 at 15:33
I'm using Spring Boot 1.5.1.RELEASE and my static resources are in src/main/resources/static. I want to prevent unauthorized users downloading certain javascript files.
– SME
Nov 21 at 15:33
Show your complete configuration class with all anotations.
– dur
Nov 22 at 21:24
Show your complete configuration class with all anotations.
– dur
Nov 22 at 21:24
It's ok. I have a work around. I created a folder call app-js and moved all the JavaScript I wanted to secure into this folder and that works.
– SME
Nov 22 at 22:15
It's ok. I have a work around. I created a folder call app-js and moved all the JavaScript I wanted to secure into this folder and that works.
– SME
Nov 22 at 22:15
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
Disable the default spring-boot resource mappings with
spring.resources.add-mappings=false
to
application.properties
answered Nov 21 at 14:33
AlexB
843
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
Disable the default spring-boot resource mappings with
spring.resources.add-mappings=false
to
application.properties
answered Nov 21 at 14:33
AlexB
843
add a comment |
up vote
0
down vote
Disable the default spring-boot resource mappings with
spring.resources.add-mappings=false
to
application.properties
answered Nov 21 at 14:33
AlexB
843
add a comment |
up vote
0
down vote
up vote
0
down vote
Disable the default spring-boot resource mappings with
spring.resources.add-mappings=false
to
application.properties
answered Nov 21 at 14:33
AlexB
843
Disable the default spring-boot resource mappings with
spring.resources.add-mappings=false
to
application.properties
answered Nov 21 at 14:33
AlexB
843
answered Nov 21 at 14:33
AlexB
843
answered Nov 21 at 14:33
AlexB
843
answered Nov 21 at 14:33
AlexB
843
843
add a comment |
add a comment |
draft saved
draft discarded
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53414209%2fsecuring-static-resources-in-a-spring-boot-app%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Those folders are served, but they're not actually within the path of any web request, so they don't match to anything. A proper solution would be to put your static resources within folders, eg.
src/main/resources/static/css/mystyle.cssand to add matchers to those, eg..antMatchers("/css/**").authenticated().– g00glen00b
Nov 21 at 14:27
Thanks but, I have tried that and it doesn't work.
– SME
Nov 21 at 14:52
1
I'm using Spring Boot 1.5.1.RELEASE and my static resources are in src/main/resources/static. I want to prevent unauthorized users downloading certain javascript files.
– SME
Nov 21 at 15:33
Show your complete configuration class with all anotations.
– dur
Nov 22 at 21:24
It's ok. I have a work around. I created a folder call app-js and moved all the JavaScript I wanted to secure into this folder and that works.
– SME
Nov 22 at 22:15