From cda7dfbaa7dc1af9b63062821513161a5b1eddf7 Mon Sep 17 00:00:00 2001 From: hsiegeln <37154749+hsiegeln@users.noreply.github.com> Date: Sat, 4 Apr 2026 23:49:43 +0200 Subject: [PATCH] fix: permit SPA routes and static assets in Spring Security The SPA (index.html, /login, /callback, /assets/*) must be accessible without authentication. API routes remain protected. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../java/net/siegeln/cameleer/saas/config/SecurityConfig.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/main/java/net/siegeln/cameleer/saas/config/SecurityConfig.java b/src/main/java/net/siegeln/cameleer/saas/config/SecurityConfig.java index 17c5225..1257b97 100644 --- a/src/main/java/net/siegeln/cameleer/saas/config/SecurityConfig.java +++ b/src/main/java/net/siegeln/cameleer/saas/config/SecurityConfig.java @@ -49,6 +49,8 @@ public class SecurityConfig { .authorizeHttpRequests(auth -> auth .requestMatchers("/actuator/health").permitAll() .requestMatchers("/auth/verify").permitAll() + .requestMatchers("/", "/index.html", "/login", "/callback", "/environments/**", "/license").permitAll() + .requestMatchers("/assets/**", "/favicon.ico").permitAll() .anyRequest().authenticated() ) .oauth2ResourceServer(oauth2 -> oauth2.jwt(jwt -> {}))