Spring Security：访问/welcome页面被重定向至登录页的解决方法

我已经在Spring Security配置中将/welcome页面设置为允许所有用户访问，但访问该页面时依然被重定向到登录页。当我设置所有请求都允许匿名访问时，所有页面都能正常访问，但仅放开/welcome时就失效了。

相关代码 #

WebSecurityConfig #

@Configuration
@EnableWebSecurity
public class WebSecurityConfig{
    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder encoder){
        UserDetails admin = User.builder().username("admin").password(encoder.encode("admin")).build();
        UserDetails user = User.builder().username("user").password(encoder.encode("user")).build(); 
        return new InMemoryUserDetailsManager(admin, user);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth
                        .requestMatchers("/welcome").permitAll()
                        .anyRequest().authenticated())
                .formLogin(withDefaults())
                .csrf(AbstractHttpConfigurer::disable);
        return http.build();

    }
    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }
}

siteController #

@Controller
public class siteController {
    @GetMapping("/welcome")
    public String welcome(){
        return "welcome.html";
    }

    @GetMapping("/admin")
    public String admin(){
        return "admin.html";
    }
}

DemoApplication #

@SpringBootApplication
public class DemoApplication {
    public static void main(String[] args) {
        SpringApplication.run(DemoApplication.class, args);
    }
}

尝试过的有效配置（全量允许匿名） #

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(auth -> auth
                    .anyRequest().permitAll())
            .formLogin(withDefaults())
            .csrf(AbstractHttpConfigurer::disable);
    return http.build();
}

解决方案 #

1. 放行页面依赖的静态资源 #

如果welcome.html引用了CSS、JS等静态资源，或者模板文件所在路径被拦截，会触发认证跳转。需要把相关路径也加入放行规则：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(auth -> auth
                    // 放行welcome页面及相关静态资源路径
                    .requestMatchers("/welcome", "/css/**", "/js/**", "/images/**").permitAll()
                    .anyRequest().authenticated())
            .formLogin(withDefaults())
            .csrf(AbstractHttpConfigurer::disable);
    return http.build();
}

2. 切换路径匹配方式（兼容旧版本） #

如果你使用的Spring Security版本低于5.7，requestMatchers可能存在兼容问题，尝试换成antMatchers：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(auth -> auth
                    .antMatchers("/welcome").permitAll()
                    .anyRequest().authenticated())
            .formLogin(withDefaults())
            .csrf(AbstractHttpConfigurer::disable);
    return http.build();
}

3. 增加路径匹配的灵活性 #

确保请求路径和配置完全一致，避免末尾斜杠或大小写差异问题，可以用模糊匹配：

.requestMatchers("/welcome/**").permitAll()

4. 清除浏览器缓存 #

旧的认证会话可能被浏览器缓存，用隐私模式打开页面或清除缓存后再测试。

内容的提问来源于stack exchange，提问作者minby