61 comments on “Spring Boot + Spring Security + Thymeleaf example”

  1. Hello Young. a very good tutorial.
    I compiled and and ran it, and found a small issue with loading the local /css/main.css file. I used Inspect in chrome browser and found the main.css is not getting loaded, with error message in the console:
    “Refused to apply style from ‘http://localhost:8080/login’ because its MIME type (‘text/html’) is not a supported stylesheet MIME type, and strict MIME checking is enabled.”
    Do you know why?

    Reply

  5. Hi!
    Why do you switch off @EnableWebSecurity in SpringSecurityConfig class? (in your zipped code)
    When switching on, I can’t see styles in all html.
    Why?

    Reply

  8. Could you please explain where are the parameters param.error and param.logout variables come from in this project?
    thanks mkyong.

    Reply

  11. hello thank u so much for your tuto it’s so interesting i need your help i wnat know if i can change the content in application.properties with the habitual content(spring.datasource.url=jdbc:mysql://localhost:3306/database
    spring.datasource.username=root
    spring.datasource.password=
    spring.datasource.driver-class-name=com.mysql.jdbc.Driver

    spring.datasource.testWhileIdle=true
    spring.datasource.validationQuery=SELECT
    spring.jpa.hibernate.naming-strategy=org.hibernate.cfg.ImprovedNamingStrategy
    spring.jpa.hibernate.ddl-auto=create
    spring.jpa.show-sql=true
    spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.MySQL5Dialect

    Reply

  12. Hi, This is really useful.

    I faced some issues when I tried this sample with my test application
    @Controller
    @RequestMapping(“/thyme”)
    public class ThymeController {
    @GetMapping(“/”)
    public String home() {
    return “/home”;
    }
    }

    when I added this (“/thyme”) mapping I used to get only Access Denied Error page only.
    After I removed it, everything is normal.

    Should not I use any other mapping? Can someone give me some explanation on this?

    Please add Password Encryption, I faced issue here.
    I had to change from this
    .withUser(“user”).password(“password”).roles(“USER”)

    this
    .withUser(“user”).password(“{noop}password”).roles(“USER”)

    Thanks!

    Reply

  14. thanks for the post, i cant get the thymeleaf sec:authentication=”name” to work , its always blank . i am using spring boot 2.1.2 and spring security 5 with thymeleaf extras.

    Reply

      1. I had the same problem and i was allowed to enter the homepage only using the generated security password, not the one set in the SpringSecurityConfig class (password)

        Reply

  16. I am authenticating the user using one of the post method in the controller. I am not using inMemoryAuthentication(). So in that case how do I proceed

    Reply

  18. Hello!
    I just followed your tutorial. Everything seems ok, I just a little problem. The static resources (css, js) were not loaded at first, untill I modify the SpringSecurityConfig, added /static and /webjars to be permitted in antMatchers. Now I think it has resolved the issue, but the main.css still not be loaded. When I see the javascript console log, it said that ‘Refused to apply style from ‘http:80801/login’ because it’s MIME type…’.

    I’ve googled it but still haven’t found any fit answer.

    Thanks.

    Reply

    1. Did you update to a newer version of the webjars in in your pom? If so, you will need to update the version references in your html files. I had the same problem and that fixed it for me.

      Reply

  19. Hi. I downloaded your project and import to Eclipse as Existing Maven Project. I build and started successfully but i got below error:
    Whitelabel Error Page
    This application has no explicit mapping for /error, so you are seeing this as a fallback.

    Tue Mar 20 11:51:03 ICT 2018
    There was an unexpected error (type=Internal Server Error, status=500).
    Error resolving template “/login”, template might not exist or might not be accessible by any of the configured Template Resolvers

    Can you please help?
    Regards,
    Long

    Reply

  20. I can’t run your example from GitHub, I’m getting this:

    Whitelabel Error Page
    This application has no explicit mapping for /error, so you are seeing this as a fallback.

    Fri Mar 09 16:08:49 CET 2018
    There was an unexpected error (type=Internal Server Error, status=500).
    Error resolving template “/login”, template might not exist or might not be accessible by any of the configured Template Resolvers

    Reply

    1. org.thymeleaf.exceptions.TemplateInputException: Error resolving template “/home”, template might not exist or might not be accessible by any of the configured Template Resolvers
      ,

      Reply

  23. No, It did not work for me..! I tried http://localhost:8080/admin, it redirected me to http://localhost:8080/login page the I entered {admin : password} correctly. It still redirected me back to /home page instead of /admin page. I then tried http://localhost:8080/user, it redirected me to /login page; I explicitly tried to go to http://localhost:8080/admin it redirected me to /login page. Looks like I can’t get past /login page. Logs do not show any error / exception.

    Reply

    2. use NoOpPasswordEncoder for inMemoryAuthentication :

      auth.inMemoryAuthentication()
      .withUser(“user”).password(“{noop}pwd”).roles(“USER”)
      .and()
      .withUser(“admin”).password(“{noop}pwd”).roles(“ADMIN”);

      Reply

  26. Hi All,

    when i run using the executable jar i am getting

    nested exception is org.thymeleaf.exceptions.TemplateInputException: Error resolving template “/login”, template might not exist or might not be accessible by any of the configured Template Resolvers] with root cause

    Please can anyone help me out.

    Reply

  29. Hi! I used you code and getting error ‘No beans of ‘AccessDeniedHandler’ type found.’ in

    @Configuration
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
    /**
    *
    */
    @Autowired
    private AccessDeniedHandler accessDeniedHandler;
    ….
    }

    Reply

    1. Hello Justyna,

      I have just tried to look around the blogs related to Spring. In this moment I saw your comment. So let’s see my answer.

      csrf().disable(); it’s intercept that spring security to disable csrf token. Normally we need to enable it for prevent CSRF. So when the browser request to web application, our web application will generate the csrf token to the browser for store in the cookie. So when the browser request again something like post our web server will check csrf token match or not!

      Reply

      1. Hello Justyna,
        how do we know the csrf token is a match or not? is it handled by spring automatically? or that thing should be handled manually?

        Reply

    1. If u wanna show logout page, u should config on SpringSecurityConfig:
      Example:
      .logout().logoutRequestMatcher(new AntPathRequestMatcher(“/logout”)).logoutSuccessUrl(“/”)

      Reply

  33. Hi. Nice post. I want just to tell you were missing the dependendy for jquery which is mandatory for bootstrap. You should add it in the pom.xml

    org.webjars
    jquery
    3.2.1

    Reply

  35. Hi,
    I need configuration which is in spring boot, jwt token security and thymeleaf, mysql with different userwise login success page. this project must run from java cmd by jar, without external tomcat….Please hepl us

    Reply

    1. In the code above…

      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

      auth.inMemoryAuthentication()
      .withUser(“user”).password(“password”).roles(“USER”)
      .and()
      .withUser(“admin”).password(“password”).roles(“ADMIN”);
      }

      Reply

  38. Thank you for putting this together.
    When I try to run this code from a command line I get an error:
    org.thymeleaf.exceptions.TemplateInputException: Error resolving template “/login”, template might not exist or might not be accessible by any of the configured Template Resolvers

    Reply

  39. Add the following code to SpringSecurityConfig.java to be able to load CSS and “webjars/bootstrap/3.3.7/css/bootstrap.min.css” when not authenticate!

    @Override
    public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers(“/webjars/**”);
    web.ignoring().antMatchers(“/css/**”,”/fonts/**”,”/libs/**”);
    }

    Reply

      1. Didn’t work for me without this code.

        When authenticated load webjars perfectly, but when not authenticated, webjars is missing and breaks the layout.

        Reply

    1. I added your code to my login process, and it works very well. I have one semantic question.

      In each of the Thymeleaf templates (about, index, admin … etc) the section has a element, although this works as you designed it, strictly speaking the head is just for meta data, is there another way of pointing to the header-css rather than using div ?

      Reply

Leave a Comment

Your email address will not be published. Required fields are marked *