[FIXED] Spring Boot + Security: How to redirect to unauthenticated index.html

Issue

I build a small API with Spring Boot. For authentication and authorization I use Spring security together with Keycloak. My current problem is, that I want to show a static index.html giving some Info about the API, when http://myserver:8080 is opened. The index.html is there and can be accessed with http://myserver:8080/index.html. However, when just opening http://myserver:8080 the request is redirected to http://localhost:8080/auth/. My questions are:

1. How can I redirect any request from the root http://localhost:8080/* to http://localhost:8080/index.html?
2. What would be a reasonable HttpSecurity configuration? I want to grand access without authentication to the root /*, but I want to require authentification for all subfolders such as /api/*. I tried the following which does not seem correct.

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http.csrf().disable().authorizeRequests().antMatchers("/*").permitAll().anyRequest().authenticated();
    }

Thank you very much

Solution

By default spring boot looks for static content files and directories that are on the classpath as below

1. /static/
2. /public/
3. /resources/
4. /META-INF/resources

So, If you want to access index.html either it should be present in the classpath or you need to configure the location. So, that spring boot is aware about the location.

If you want to configure the location present in the classpath

spring.web.resources.static-locations=classpath:/files/

or if you want to configure the location outside of classpath then also you can do soething like below,

spring.web.resources.static-locations=file:<path_to_file>

Reference: https://spring.io/blog/2013/12/19/serving-static-web-content-with-spring-boot

Answered By - Rishal
Answer Checked By - Terry (JavaFixing Volunteer)