From bc384a6d2d9aaa46e702f7cdc899a5651ef8c41f Mon Sep 17 00:00:00 2001 From: hsiegeln <37154749+hsiegeln@users.noreply.github.com> Date: Sun, 5 Apr 2026 22:40:41 +0200 Subject: [PATCH] fix: permit /_app/** static assets in SecurityConfig SPA assets moved from /assets/ to /_app/ for single-domain routing, but SecurityConfig still permitted the old path. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../java/net/siegeln/cameleer/saas/config/SecurityConfig.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/net/siegeln/cameleer/saas/config/SecurityConfig.java b/src/main/java/net/siegeln/cameleer/saas/config/SecurityConfig.java index e8e09a0..0f56a4b 100644 --- a/src/main/java/net/siegeln/cameleer/saas/config/SecurityConfig.java +++ b/src/main/java/net/siegeln/cameleer/saas/config/SecurityConfig.java @@ -40,7 +40,7 @@ public class SecurityConfig { .requestMatchers("/api/config").permitAll() .requestMatchers("/", "/index.html", "/login", "/callback", "/environments/**", "/license", "/admin/**").permitAll() - .requestMatchers("/assets/**", "/favicon.ico").permitAll() + .requestMatchers("/_app/**", "/favicon.ico").permitAll() .anyRequest().authenticated() ) .oauth2ResourceServer(oauth2 -> oauth2.jwt(jwt ->