Fix Spring Security Access Denied Error for Root Path in Spring Boot with JSP

The spring security access denied error occurs when accessing the root path ‘/’ in Spring Boot applications with JSP views because Spring Security blocks requests to /WEB-INF/** resources by default. When your controller forwards to a JSP file internally, Spring Security treats this as a request to a protected resource, triggering the access denied exception even though you’ve permitted access to ‘/’ in your security configuration. The proper solution involves using ViewControllerRegistry to map the root path directly to your JSP view without relying on Spring Security’s default resource protection mechanisms.

Contents

• Understanding the Root Cause
• Solution 1: Using ViewControllerRegistry
• Solution 2: Custom ViewResolver Configuration
• Solution 3: Security Context Configuration
• Alternative Approaches
• Best Practices

Understanding the Root Cause

When you develop a Spring Boot application with JSP views and Spring Security, you might encounter the frustrating spring security access denied error even when your configuration explicitly allows access to the root path ‘/’. This happens due to how Spring MVC and Spring Security interact with JSP files.

The issue stems from the fact that Spring Security, by default, blocks access to any resources under the /WEB-INF/** directory. JSP files are typically stored in this protected directory for security reasons. When a controller returns a view name like “welcome”, the InternalResourceViewResolver forwards the request internally to /WEB-INF/views/welcome.jsp. This internal forward is treated as a new request by Spring Security, which sees it as a request to /WEB-INF/** and blocks it.

According to GeeksforGeeks, “Spring Security blocks requests that target resources under /WEB-INF/** because the container treats that folder as a protected area.” This protection mechanism is actually a security feature, but it can cause issues when your application architecture relies on MVC view resolution.

The spring boot jsp security configuration needs to account for this internal forwarding behavior. Even if your security configuration permits access to ‘/’, the actual JSP file resides in /WEB-INF/views/, creating a mismatch between what the browser requests and what Spring Security ultimately protects.

This architectural consideration is crucial when working with traditional MVC applications that use JSP as the view technology. Understanding this interaction helps you implement proper solutions without compromising security.

Solution 1: Using ViewControllerRegistry

The most elegant solution to resolve the spring security access denied error is to use the ViewControllerRegistry to map the root path directly to your JSP view. This approach bypasses the controller processing and directly maps the URL to a view, avoiding the internal forward that triggers Spring Security’s protection mechanism.

In your WebMvcConfigurer configuration class, add the following code:

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {
    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/")
               .setViewName("forward:/index");
    }
}

This configuration maps the root path ‘/’ to forward to the view named “index”. The InternalResourceViewResolver will then resolve this to /WEB-INF/views/index.jsp, but the forwarding happens at the MVC level rather than through Spring Security’s filters.

The advantage of this approach is that it keeps your security configuration clean and focused on actual security concerns rather than view resolution details. As noted in the GeeksforGeeks article, “Spring MVC’s ViewResolver maps the logical view name returned by a controller to the actual view (e.g., a JSP file). It keeps controller code clean by avoiding hard-coded paths.”

For more complex scenarios, you might need to map multiple paths:

@Override
public void addViewControllers(ViewControllerRegistry registry) {
    registry.addViewController("/")
           .setViewName("forward:/index");
    registry.addViewController("/login")
           .setViewName("forward:/login");
    registry.addViewController("/home")
           .setViewName("forward:/home");
}

This solution is particularly effective for the spring boot access denied root issue because it creates a direct mapping between the URL and the view, eliminating the internal forward that Spring Security interprets as a protected resource access.

Solution 2: Custom ViewResolver Configuration

Another approach to resolve the spring security access denied error involves customizing the ViewResolver configuration to handle the root path differently. This method allows you to maintain your security configuration while ensuring that JSP views are properly resolved without triggering Spring Security’s protections.

The key is to configure a custom InternalResourceViewResolver that explicitly handles the root path mapping:

@Configuration
public class WebMvcConfig {
    
    @Bean
    public ViewResolver viewResolver() {
        InternalResourceViewResolver resolver = new InternalResourceViewResolver();
        resolver.setPrefix("/WEB-INF/views/");
        resolver.setSuffix(".jsp");
        resolver.setViewClass(JstlView.class);
        
        // Add a custom property to handle root path
        resolver.setRedirectContextRelative(false);
        return resolver;
    }
}

Additionally, you can create a custom controller that specifically handles the root path:

@Controller
public class RootController {
    
    @GetMapping("/")
    public String rootPath() {
        return "index";  // This maps to /WEB-INF/views/index.jsp
    }
}

According to Centron’s comprehensive guide, “Spring MVC’s ViewResolver resolves view names to actual JSP files. When your controller returns a view name, the InternalResourceViewResolver forwards internally to /WEB-INF/views/yourPage.jsp. The forward is treated as a new request and Spring Security sees it as a request to /WEB-INF/**.”

This solution works because the controller explicitly returns the view name, which the ViewResolver then resolves to the correct JSP file. The internal forward is now part of the normal MVC flow rather than a direct request to a protected resource.

For more advanced scenarios, you might implement a custom ViewResolver that handles specific patterns:

@Bean
public ViewResolver customViewResolver() {
    ResourceBundleViewResolver resolver = new ResourceBundleViewResolver();
    resolver.setBasename("views");
    return resolver;
}

Then create a views.properties file in your resources directory:

welcome.(class)=org.springframework.web.servlet.view.InternalResourceView
welcome.url=/WEB-INF/views/welcome.jsp

This approach gives you fine-grained control over how views are resolved and can help prevent the spring boot access denied root error by ensuring that the view resolution process doesn’t trigger Spring Security’s protections.

Solution 3: Security Context Configuration

If you prefer to keep your security configuration intact while resolving the spring security access denied error, you can adjust your Spring Security configuration to handle the specific case of JSP view resolution without broadly opening the /WEB-INF/** directory.

The key insight here is that Spring Security’s default configuration blocks access to /WEB-INF/**, but we can create a more nuanced approach that allows specific access patterns while maintaining security for the rest of the application.

First, examine your current security configuration:

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/login").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .permitAll()
            )
            .logout(logout -> logout
                .permitAll()
            );
            
        return http.build();
    }
}

To resolve the issue without broadly permitting /WEB-INF/**, you can add a more specific authorization rule:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/", "/login").permitAll()
            .requestMatchers("/WEB-INF/views/**").permitAll() // This is what you want to avoid
            .anyRequest().authenticated()
        )
        .formLogin(form -> form
            .loginPage("/login")
            .permitAll()
        )
        .logout(logout -> logout
            .permitAll()
        );
        
    return http.build();
}

However, since you want to avoid adding /WEB-INF/** to permitAll(), consider this alternative approach using a custom security filter:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/", "/login").permitAll()
            .anyRequest().authenticated()
        )
        .formLogin(form -> form
            .loginPage("/login")
            .permitAll()
        )
        .exceptionHandling(exc -> exc
            .accessDeniedHandler((request, response, accessDeniedException) -> {
                // Check if the request is for a JSP view
                String requestURI = request.getRequestURI();
                if (requestURI.contains(".jsp")) {
                    // Forward to the actual view
                    request.getRequestDispatcher(requestURI).forward(request, response);
                } else {
                    // Default access denied handling
                    response.sendError(HttpServletResponse.SC_FORBIDDEN);
                }
            })
        );
        
    return http.build();
}

This approach intercepts access denied exceptions and handles them specifically for JSP files, forwarding the request directly to the JSP resource without going through Spring Security’s filters again.

While this solution addresses the immediate spring boot access denied root issue, it’s worth noting that it adds complexity to your security configuration. The previous solutions using ViewControllerRegistry or custom ViewResolver configurations are generally cleaner and more aligned with Spring MVC best practices.

Alternative Approaches

Beyond the primary solutions discussed, there are several alternative approaches you can consider to resolve the spring security access denied error for JSP views in your Spring Boot application. Each approach has its own advantages and trade-offs in terms of complexity, maintainability, and security.

Using a Custom Controller Forward

One straightforward alternative is to create a custom controller that explicitly forwards requests to JSP views. This approach keeps your security configuration clean while providing a clear mapping between URLs and views:

@Controller
public class ViewController {
    
    @GetMapping("/")
    public String forwardToIndex() {
        return "forward:/WEB-INF/views/index.jsp";
    }
    
    @GetMapping("/home")
    public String forwardToHome() {
        return "forward:/WEB-INF/views/home.jsp";
    }
}

This solution works because the forward directive happens within the controller, before Spring Security’s filters have a chance to intercept the request to /WEB-INF/**.

Implementing a ResourceHandler

For applications that need to serve static resources along with JSP views, you can configure a ResourceHandler to handle specific patterns:

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {
    
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/resources/**")
               .addResourceLocations("/resources/");
    }
    
    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/")
               .setViewName("forward:/index");
    }
}

This approach separates static resource handling from view resolution, which can help prevent conflicts between Spring Security’s protections and your application’s view rendering needs.

Using a Custom Authentication Success Handler

In some cases, the access denied error might be related to the authentication flow rather than the view resolution. You can customize the authentication success handler to ensure proper redirection after login:

@Bean
public AuthenticationSuccessHandler authenticationSuccessHandler() {
    return new AuthenticationSuccessHandler() {
        @Override
        public void onAuthenticationSuccess(HttpServletRequest request, 
                                          HttpServletResponse response,
                                          Authentication authentication) {
            // Redirect to the root path after successful authentication
            response.sendRedirect("/");
        }
    };
}

Then configure it in your security configuration:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/", "/login").permitAll()
            .anyRequest().authenticated()
        )
        .formLogin(form -> form
            .loginPage("/login")
            .successHandler(authenticationSuccessHandler())
            .permitAll()
        );
        
    return http.build();
}

Thymeleaf as an Alternative View Technology

If you’re open to changing your view technology, Thymeleaf offers a different approach to view resolution that might work better with Spring Security:

@Configuration
public class WebMvcConfig {
    
    @Bean
    public ITemplateResolver templateResolver() {
        SpringResourceTemplateResolver resolver = new SpringResourceTemplateResolver();
        resolver.setPrefix("classpath:/templates/");
        resolver.setSuffix(".html");
        resolver.setTemplateMode(TemplateMode.HTML);
        return resolver;
    }
    
    @Bean
    public SpringTemplateEngine templateEngine(ITemplateResolver templateResolver) {
        SpringTemplateEngine engine = new SpringTemplateEngine();
        engine.setTemplateResolver(templateResolver);
        return engine;
    }
    
    @Bean
    public ViewResolver viewResolver(SpringTemplateEngine templateEngine) {
        ThymeleafViewResolver resolver = new ThymeleafViewResolver();
        resolver.setTemplateEngine(templateEngine);
        return resolver;
    }
}

Thymeleaf templates are typically stored in the classpath rather than /WEB-INF/, which avoids the Spring Security protections that block access to JSP files.

Each of these alternative approaches offers a different way to address the spring boot access denied root issue while maintaining the integrity of your security configuration. The best approach depends on your specific application requirements, existing architecture, and long-term maintenance considerations.

Best Practices

When addressing the spring security access denied error in Spring Boot applications with JSP views, following best practices ensures that your solution is not only effective but also maintainable, secure, and aligned with Spring framework conventions.

Keep Security Configuration Focused

Your security configuration should remain focused on security concerns rather than view resolution details. Avoid broad permissions like permitAll() for /WEB-INF/** as this can potentially expose sensitive resources. Instead, implement solutions that address the architectural issue without compromising security.

The Centron guide emphasizes that security configurations should be precise and purposeful. When you find yourself adding overly broad permissions to resolve issues, it’s often a sign that there’s a better architectural solution available.

Prefer ViewControllerRegistry for Static Mappings

For simple mappings like the root path ‘/’, using ViewControllerRegistry is the cleanest approach. This keeps your controllers focused on business logic while handling static view mappings in a dedicated place.

@Override
public void addViewControllers(ViewControllerRegistry registry) {
    registry.addViewController("/")
           .setViewName("forward:/index");
}

This approach is recommended by the Spring MVC documentation as it separates concerns and makes your configuration more maintainable.

Maintain Consistent View Resolution

Ensure that your view resolution approach is consistent across your application. If you use ViewControllerRegistry for the root path, consider using it for other static view mappings as well to maintain consistency.

Inconsistent view resolution patterns can lead to confusion and maintenance issues down the line. When developers on your team need to add new views, they should follow a clear, established pattern.

Consider the Evolution of Your Application

Think about how your application might evolve over time. If you’re planning to migrate from JSP to a modern view technology like Thymeleaf or React, choose solutions that won’t make that migration more difficult.

The GeeksforGeeks article notes that JSP view resolution has specific quirks that don’t exist with other view technologies. Keeping this in mind when designing your solution can save you future refactoring effort.

Test Security Thoroughly

After implementing any solution to resolve the access denied error, thoroughly test your application’s security. Ensure that:

1. Publicly accessible pages (like login and registration) work correctly
2. Protected resources remain inaccessible to unauthorized users
3. Authentication and authorization flows work as expected

Security issues often manifest in subtle ways, so comprehensive testing is essential.

Document Your Configuration Decisions

When choosing a specific approach to resolve the spring boot access denied root issue, document your decision and the reasoning behind it. This helps future developers understand the architectural choices and prevents well-intentioned but misguided changes.

Consider Performance Implications

Different approaches to view resolution can have performance implications. For example, using ViewControllerRegistry for static mappings is generally more efficient than routing everything through controllers, especially for high-traffic applications.

The DEV Community article mentions that some security configurations can impact performance, particularly when dealing with asynchronous requests or Server-Sent Events.

Stay Updated with Spring Boot and Security Versions

Spring Boot and Spring Security are actively evolving, with new features and improvements in each version. Stay updated with the latest releases, as newer versions might offer better solutions to common problems like the access denied error.

By following these best practices, you can implement a robust, maintainable solution to the spring security access denied error that aligns with Spring framework conventions and maintains the security of your application.

Conclusion

The spring security access denied error for the root path ‘/’ in Spring Boot applications with JSP views is a common architectural challenge that stems from the interaction between Spring MVC’s view resolution and Spring Security’s resource protection mechanisms. By understanding the root cause—Spring Security’s default blocking of /WEB-INF/** resources and how internal forwards trigger this protection—you can implement targeted solutions that resolve the issue without compromising security.

The most recommended approach is using ViewControllerRegistry to map the root path directly to your JSP view, which bypasses the controller processing and avoids the internal forward that triggers Spring Security’s protections. This solution keeps your security configuration clean and focused on actual security concerns rather than view resolution details.

Alternative approaches include custom ViewResolver configurations, adjusted security contexts, and even considering modern view technologies like Thymeleaf. Each solution has its own advantages depending on your specific application architecture and requirements.

Regardless of the approach you choose, maintaining a security-first mindset while resolving these issues is crucial. By following best practices like keeping security configurations focused, preferring static mappings for simple cases, and thoroughly testing your application, you can resolve the spring boot access denied root error effectively while maintaining the integrity and security of your Spring Boot application.

Sources

• Solving Access Denied Issues After SSE Implementation in Spring Security - DEV Community
• Spring Security - Deny Access to All URLs - GeeksforGeeks
• ViewResolver in Spring MVC - GeeksforGeeks
• Spring Security Login: A Comprehensive Guide - Centron