title: Resource blocked due to MIME type in Spring MVC when DELETE endpoint added
body: <p>I'm developing a web app using Spring Boot v2.1.9.RELEASE and Thymeleaf. The app mixes server-side rendering (Spring MVC regular controllers) with rest controllers called through AJAX. The page works like a charm as long as <code>GET</code> and <code>POST</code> are the only HTTP methods I use. As soon as I add a - totally unrelated, yet unused - <code>DELETE</code> REST controller, CSS and JS resources stop being loaded and errors like the following are shown in browser console:</p>
  
  <p><code>The resource from “http://localhost:8080/css/demo.css” was blocked due to MIME type (“application/json”) mismatch (X-Content-Type-Options: nosniff)</code></p>
  
  <p>If I remove the new controller, the page starts working again.</p>
  
  <p>When I inspect the request with Network Monitor, I observe that:</p>
  
  <ul>
  <li><code>X-Content-Type-Options: nosniff</code> header is always present in the response, which is consistent with <a href="https://docs.spring.io/autorepo/docs/spring-security/4.0.x/reference/html/headers.html" rel="nofollow noreferrer">Spring Security documentation</a>.</li>
  <li>if the <code>DELETE</code> endpoint is not there, a <code>GET /css/demo.css</code> request returns with a <code>HTTP 200</code> code as expected. Both <code>Accept</code> (request header) and <code>Content-Type</code> (response header) are marked as <code>text/css</code>.</li>
  <li>when I add the endpoint, the above request returns a <code>HTTP 405</code>. <code>Accept</code> header is <code>text/css</code> but <code>Content-Type</code> becomes <code>application/json</code>. Also, a new response header is added: <code>Allow: DELETE</code>.</li>
  </ul>
  
  <p>My guess is that when Spring scans for controllers and a <code>DELETE</code> method is found, some extra configuration is automatically added, but I couldn't find any reference to confirm that. I would like to know why is this happening and how can I avoid this behaviour.</p>
  
  <p>Since I'm developing local, my Spring Security config is pretty straightforward:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Bean
      public AuthenticationManagerConfigurer authConfigurer() {
          return new InMemoryAuthenticationManagerConfigurer();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          authConfigurer().configure(auth);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
              .anyRequest()
              .authenticated()
              .and()
              .formLogin();
      }
  
      @Bean
      public PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }
  }
  </code></pre>
  
  <p>The REST controller I'm adding does almost nothing:</p>
  
  <pre><code>@RestController
  public class MotivosController {
  
      private final String CONTROLLER_PATH = "/rest/motivos/{id}";
  
      @RequestMapping(name=CONTROLLER_PATH, method=RequestMethod.DELETE)
      public void deleteMotivo(@PathVariable(name="id") String id) {
          logger.debug("Eliminando el motivo " + id);
      }
  
      // Other members I consider unrelated to the problem go here...
  }
  </code></pre>
  
  <p>CSS and JS files are being loaded in a <code>template.html</code> file placed under <code>src/main/resources/templates</code> folder, as follows:</p>
  
  <p><code>&lt;link type="text/css" href="/css/demo.css" rel="stylesheet" /&gt;</code></p>