title: SpringBoot public Matchers
body: <p>I have a Spring Boot application with this mappging:</p>
  <pre class="lang-java prettyprint-override"><code>@GetMapping(value = {  &quot;/&quot;,  })
  public String home(Model model) {
  }
  </code></pre>
  <p>and</p>
  <ul>
  <li><code>localhot:8080</code>,</li>
  <li><code>localhost:8080/</code> ,</li>
  <li><code>localhost:8080/.</code>,</li>
  <li><code>localhost:8080/..</code></li>
  </ul>
  <p>redirects to <code>/</code> but not</p>
  <pre><code>localhost:8080/...
  </code></pre>
  <p>and in the <code>WebSecurityConfig</code> the only public matcher I have is this one: <code>/</code>.</p>
  <p>I would like to restrict the access for <code>localhost:8080/.</code> and <code>localhost:8080/..</code></p>
  <p>here:</p>
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      private final UserSecurityService userSecurityService;
      private final Environment env;
  
      private static final String SALT = &quot;fd&amp;l23j§sfs23#$1*(_)nof&quot;;
  
      public WebSecurityConfig(UserSecurityService userSecurityService, Environment env) {
          this.userSecurityService = userSecurityService;
          this.env = env;
      }
  
      @Bean
      public BCryptPasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder(12, new SecureRandom(SALT.getBytes()));
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          CharacterEncodingFilter encodingFilter = new CharacterEncodingFilter();
          encodingFilter.setEncoding(&quot;UTF-8&quot;);
          encodingFilter.setForceEncoding(true);
  
          http.addFilterBefore(encodingFilter, CsrfFilter.class);
      
          http.csrf().disable();
      
          http
              .authorizeRequests()
                  .antMatchers(publicMatchers()).permitAll()
                  .anyRequest().authenticated()
                  .and()
              .formLogin()
                  .loginPage(&quot;/login.html&quot;)
                  .defaultSuccessUrl(&quot;/advertise.html&quot;)
                  .failureUrl(&quot;/login.html?error&quot;).permitAll()
                  .and()
              .logout()
                  .permitAll()
                  .and()
              .rememberMe()
                  .key(&quot;uniqueAndSecret&quot;);
      }
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  
          auth
              .userDetailsService(userSecurityService)
                  .passwordEncoder(passwordEncoder());
      }
  
      private String[] publicMatchers() {
  
          final String[] PUBLIC_MATCHERS = {
                  &quot;/webjars/**&quot;,
                  &quot;/css/**&quot;,
                  &quot;/fonts/**&quot;,
                  &quot;/images/**&quot;,
                  &quot;/img/**&quot;,
                  &quot;/js/**&quot;,
                  &quot;/home.html&quot;,
                  &quot;/links/**&quot;,
                  &quot;/links.html&quot;,
                  &quot;/favicon.ico&quot;,
                  &quot;/forgotmypassword.html&quot;,
                  &quot;/directory/**&quot;,
                  &quot;/&quot;,
                  &quot;/error/**/*&quot;,
                  &quot;/h2-console/**&quot;,
                  ForgotMyPasswordController.FORGOT_PASSWORD_URL_MAPPING,
                  ForgotMyPasswordController.CHANGE_PASSWORD_PATH
          };
  
          return PUBLIC_MATCHERS;
      }
  }
  </code></pre>