title: Spring Security returning 302 for all static content configured with security none
body: <p>I was using this security configuration:</p>
  
  <pre><code>&lt;security:http pattern="/app/.*" security="none" /&gt;
  &lt;security:http pattern="/assets/.*" security="none" /&gt;
  
  &lt;security:http jaas-api-provision="true" request-matcher="regex" use-expressions="true" entry-point-ref="defaultLoginUrlAuthenticationEntryPoint"&gt;
      &lt;security:csrf disabled="true"/&gt;
      &lt;security:intercept-url pattern="/index\.html.*" access="isAuthenticated()"/&gt;
      &lt;security:intercept-url pattern="/services/.*" access="isAuthenticated()"/&gt;
      &lt;security:custom-filter before="FORM_LOGIN_FILTER" ref="myAuthenticationFilter"/&gt;
      &lt;security:custom-filter before="LAST" ref="myTokenFilter"/&gt;
      &lt;security:form-login authentication-failure-handler-ref="defaultAuthenticationFailureHandler" 
                           authentication-success-handler-ref="defaultSuccessHandler"
                           login-processing-url="/login"/&gt;
      &lt;security:access-denied-handler ref="defaultAccessDeniedHandler"/&gt;
      &lt;security:logout delete-cookies="user" success-handler-ref="defaultLogoutHandler" logout-url="/logout"/&gt;
  &lt;/security:http&gt;
  </code></pre>
  
  <p>The application works fine using it but there is a performance issue because the security none configuration is wrong (I am using regex pattern while the default is ant) and myTokenFilter call a rest service more times than I need.
  I correct the config like below:</p>
  
  <pre><code>&lt;security:http request-matcher="regex" pattern="/app/.*" security="none" /&gt;
  &lt;security:http request-matcher="regex" pattern="/assets/.*" security="none" /&gt; 
  </code></pre>
  
  <p>Now the filter works correctly but the application doesn't work anymore. All static request return 302 and redirect to logout. I change my logout url for avoid redirect back to portal and I saw this in browser.</p>
  
  <p>Old config (working).</p>
  
  <p><a href="http://i.stack.imgur.com/AjlxO.jpg" rel="nofollow">Working</a></p>
  
  <p>New config:</p>
  
  <p><a href="http://i.stack.imgur.com/RKhMS.jpg" rel="nofollow">Not Working</a></p>
  
  <p>Beyond the logout, I note the browser recognize js files like json with no reason.</p>
  
  <p>My application use angular and spring boot. Currently, static resource is configured using properties:</p>
  
  <pre><code>spring.resources.static-locations=classpath:/META-INF/resources/webjars/web-template/,classpath:/static/
  </code></pre>
  
  <p>Before I use bean config:</p>
  
  <pre><code>@Override
      public void addResourceHandlers(ResourceHandlerRegistry registry) {
          registry.addResourceHandler("/**")
              .addResourceLocations("classpath:/META-INF/resources/webjars/web-template/")
              .addResourceLocations("classpath:/static/");
      }
  </code></pre>
  
  <p>A simple log trying directly access a js file.</p>
  
  <pre><code>2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-4] o.s.b.c.web.OrderedRequestContextFilter  : Bound request context to thread: org.apache.catalina.connector.RequestFacade@7e25c043
  2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-4] o.s.s.w.u.matcher.RegexRequestMatcher    : Checking match of request : '/app/view/service.js'; against '/app/.*'
  2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-4] o.s.security.web.FilterChainProxy        : /app/view/service.js has an empty filter list
  2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-4] o.s.b.c.web.OrderedRequestContextFilter  : Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade@7e25c043
  2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.b.c.web.OrderedRequestContextFilter  : Bound request context to thread: org.apache.catalina.connector.RequestFacade@7e25c043
  2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.s.w.u.matcher.RegexRequestMatcher    : Checking match of request : '/logout'; against '/app/.*'
  2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.s.w.u.matcher.RegexRequestMatcher    : Checking match of request : '/logout'; against '/assets/.*'
  2016-04-29 15:02:37.700 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.security.web.FilterChainProxy        : /logout at position 1 of 16 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
  2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
  2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.security.web.FilterChainProxy        : /logout at position 2 of 16 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
  2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.security.web.FilterChainProxy        : /logout at position 3 of 16 in additional filter chain; firing Filter: 'HeaderWriterFilter'
  2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.security.web.FilterChainProxy        : /logout at position 4 of 16 in additional filter chain; firing Filter: 'LogoutFilter'
  2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/logout'; against '/logout'
  2016-04-29 15:02:37.715 DEBUG 7372 --- [http-nio-9082-exec-5] o.s.s.w.a.logout.LogoutFilter            : Logging out user 'null' and transferring to logout destination
  </code></pre>
  
  <p>Any idea about this weird behaviour?</p>
  
  <p>Edit:
  I was using spring-io-platform version 2.0.1-RELEASE and updated to 2.0.3 trying to solve this issue.</p>
  
  <p>Edit: Configuration converted to Java Config with no solution.</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @ImportResource("classpath:application-context-ui-security.xml")
  @Profile(DEFAULT_PROFILE)
  protected static class SecurityUIApplication extends WebSecurityConfigurerAdapter {
  
      @Inject
      private MyAuthenticationFilter myAuthenticationFilter;
  
      @Inject 
      private MyTokenFilter myTokenFilter;
  
      @Inject
      private DefaultAuthenticationFailureHandler defaultAuthenticationFailureHandler;
  
      @Inject
      private AuthenticationSuccessHandler defaultSuccessHandler;
  
      @Inject
      private DefaultAccessDeniedHandler defaultAccessDeniedHandler;
  
      @Resource
      private DefaultLogoutHandler defaultLogoutHandler;
  
      @Inject
      private DefaultLoginUrlAuthenticationEntryPoint defaultLoginUrlAuthenticationEntryPoint;
  
      @Override
      public void configure(WebSecurity web) throws Exception {
           web.ignoring().regexMatchers("/app/.*", "/assets/.*");
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.csrf().disable()
              .exceptionHandling().accessDeniedHandler(defaultAccessDeniedHandler)
              .authenticationEntryPoint(defaultLoginUrlAuthenticationEntryPoint)
          .and()
              .addFilterBefore(myAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
              .addFilterBefore(myTokenFilter, AnonymousAuthenticationFilter.class)
          .authorizeRequests()
              .antMatchers("/index.html**","/services/**").authenticated()
              .anyRequest().permitAll()
          .and().formLogin()
              .failureHandler(defaultAuthenticationFailureHandler)
              .loginProcessingUrl("/login")
              .successHandler(defaultSuccessHandler)
          .and().logout()
              .logoutSuccessHandler(defaultLogoutHandler)
              .deleteCookies("user")
              .logoutUrl("/logout")
              ;
      }
  
  }
  </code></pre>
  
  <p>I still importing a xml because I need to import framework xml and there are a abstract bean to override But is just a properties.</p>