Spring集成Thymeleaf无法返回login.html页面问题求助

Looks like you're hitting a classic conflict between Spring Security's configuration and Thymeleaf view resolution for your login page. Let's break down the problem and fix it step by step.

1. Check Your Controller Annotation #

First, confirm your controller class uses @Controller instead of @RestController. The @RestController annotation automatically adds @ResponseBody to all methods, which means your return value ("login") gets sent directly as plain text instead of being resolved to a Thymeleaf template. If you accidentally used @RestController, switching to @Controller will let Spring handle the return value as a view name.

2. Correct the Controller's Return Value #

Your controller method should return "login" (without the leading slash) instead of "/login" or "login.html". Thymeleaf's default view resolver uses classpath:/templates/ as the prefix and .html as the suffix, so returning "login" maps perfectly to classpath:/templates/login.html.

Update your controller method to:

@GetMapping("/login")
public String login() {
    return "login";
}

3. Explicitly Permit Access to the Login Path #

While formLogin().permitAll() should theoretically allow access to your login page, explicitly adding /login to the permitted paths eliminates any ambiguity. Modify your configure(HttpSecurity) method to include /login in the list of unauthenticated paths:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/", "/home", "/about", "/login").permitAll() // Add /login here
        .antMatchers("/admin/**").hasAnyRole("ADMIN")
        .antMatchers("/user/**").hasAnyRole("USER")
        .anyRequest().authenticated()
        .and()
        .formLogin()
        .loginPage("/login")
        .permitAll()
        .and()
        .logout()
        .permitAll();
}

4. Update Authentication Configuration #

Your configureGlobal method uses an outdated @Autowired approach. Instead, override the configure(AuthenticationManagerBuilder) method directly to set up in-memory users correctly:

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth
        .inMemoryAuthentication()
        .withUser("user").password(passwordEncoder().encode("password")).roles("USER")
        .and()
        .withUser("admin").password(passwordEncoder().encode("admin")).roles("ADMIN");
}

5. Verify Thymeleaf Setup #

Double-check your application.properties to ensure Thymeleaf is configured properly:

spring.thymeleaf.prefix=classpath:/templates/
spring.thymeleaf.suffix=.html
spring.thymeleaf.mode=HTML
spring.thymeleaf.cache=false # Disable cache during development

Also, confirm you have the necessary dependencies in your pom.xml (Maven):

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity5</artifactId>
</dependency>

Why This Works #

When you commented out the configure(HttpSecurity) method, Spring Security used its default relaxed configuration, so your controller could resolve the Thymeleaf template normally. With the custom security config in place, you needed to explicitly allow unauthenticated access to the login page and ensure your controller's return value was properly mapped to the template file.

内容的提问来源于stack exchange，提问作者Caner Aydın