title: How to restrict access to .html pages using Spring Boot REST
body: <p>I'm trying to restrict access to a page called <code>dashboard.html</code> to unauthenticated users. So far, I've had no success. Here's my <code>WebSecurityConfigurerAdapter</code>:</p>
  
  <pre><code>@Configuration
  @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  public class CustomWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private CustomAuthenticationSuccessHandler authenticationSuccessHandler;
  
      @Autowired
      private CustomAuthenticationFailureHandler authenticationFailureHandler;
  
      @Autowired
      private CustomUserDetailsService userDetailsService;
  
      @Autowired
      private TokenAuthenticationService tokenAuthenticationService;
  
      @Bean
      public BCryptPasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }
  
      @Bean
      @Override
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder builder) throws Exception {
          builder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
                  .antMatchers("/index.html", "/",
                           "/login.html","/signup.html", "/videos/**",
                           "/login", "/logout", "/images/**", "/fonts/**",
                           "/css/**", "/js/**", "/pages/**", "/sass/**"
                           ).permitAll()
                  .and()
              .authorizeRequests()
                  .antMatchers("/dashboard/**", "/dashboard.html/**").authenticated()         
                  .and()
              .authorizeRequests()
                  .anyRequest().authenticated()
                  .and()
              .addFilterBefore(new StatelessLoginFilter("/login", tokenAuthenticationService, userDetailsService, authenticationManager()), UsernamePasswordAuthenticationFilter.class)
              .addFilterBefore(new StatelessAuthenticationFilter(tokenAuthenticationService), UsernamePasswordAuthenticationFilter.class)
              .formLogin()
                  .loginPage("/login.html")
                  .loginProcessingUrl("/login")
                  .usernameParameter("email")
                  .passwordParameter("password")
                  .successHandler(authenticationSuccessHandler)
                  .failureHandler(authenticationFailureHandler)
                  .and()
              .logout()
                  .logoutSuccessUrl("/")
                  .deleteCookies("JSESSIONID")
                  .permitAll()
                  .and()
              .csrf()
                  .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                  .and()
              .addFilterAfter(new CsrfTokenFilter(), CsrfFilter.class);
      }
  }
  </code></pre>
  
  <p>Whenever I have it set up this way, whenever I try to login, an infinite redirect loop is caused. The browser tries to navigate to <code>dashboard.html</code> but is restricted. This causes a redirect to the login page, which tries to redirect to the dashboard since there is a valid token.</p>
  
  <p>If I have it set up like below, everyone can access <code>dashboard.html</code> and make calls to the <code>/dashboard</code> endpoint which is not desired:</p>
  
  <pre><code>            http
                  .authorizeRequests()
                       .antMatchers("/index.html", "/",
                               "/login.html","/signup.html", "/videos/**",
                               "/login", "/logout", "/images/**", "/fonts/**",
                               "/css/**", "/js/**", "/pages/**", "/sass/**",
                               "/dashboard/**", "/dashboard.html/**").permitAll()
                       .and()
                  .authorizeRequests()
                       .anyRequest().authenticated()   
  </code></pre>
  
  <p>My login uses JWT tokens and uses the filter below to set the <code>SecurityContext</code> placeholder:</p>
  
  <pre><code>class StatelessLoginFilter extends AbstractAuthenticationProcessingFilter {
  
      private final TokenAuthenticationService tokenAuthenticationService;
  
      private final CustomUserDetailsService userDetailsService;
  
      protected StatelessLoginFilter(String urlMapping, TokenAuthenticationService tokenAuthenticationService,
              CustomUserDetailsService userDetailsService, AuthenticationManager authManager) {
          super(new AntPathRequestMatcher(urlMapping));
          this.userDetailsService = userDetailsService;
          this.tokenAuthenticationService = tokenAuthenticationService;
          setAuthenticationManager(authManager);
      }
  
      @Override
      public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
              throws AuthenticationException, IOException, ServletException {
          final BusinessUser user = new ObjectMapper().readValue(request.getInputStream(), BusinessUser.class);
          final UsernamePasswordAuthenticationToken loginToken = new UsernamePasswordAuthenticationToken(
                  user.getEmail(), user.getPassword());
          return getAuthenticationManager().authenticate(loginToken);
      }
  
      @Override
      protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
              FilterChain chain, Authentication authentication) throws IOException, ServletException {
  
          final BusinessUser authenticatedUser = userDetailsService.loadUserByUsername(authentication.getName());
          final UserAuthentication userAuthentication = new UserAuthentication(authenticatedUser);
  
          tokenAuthenticationService.addAuthentication(response, userAuthentication);
  
          SecurityContextHolder.getContext().setAuthentication(userAuthentication);
      }
  </code></pre>
  
  <p>I'm using the line <code>SecurityContextHolder.getContext().setAuthentication(userAuthentication);</code> to set the authentication. This works perfectly fine. If a user is found in the DB matching the credentials sent from the user, then the security context is usable to retrieve various data associated to the user. </p>
  
  <p><strong>MY QUESTION:</strong> How can I restrict the page <code>dashboard.html</code> and calls to the <code>/dashboard</code> endpoint to unauthenticated users (those without an authentication object inside the <code>SecurityContextHolder</code>)?</p>