title: Spring Security "Refused to execute script from ..."
body: <p>I'm building a Spring MVC application with Spring Security and Bootstrap in my HTML files (thymeleaf templates). The Spring Security part is based on the Spring Guide <a href="http://spring.io/guides/gs/securing-web/">for Spring Security</a> and combined with a Spring Boot application server.</p>
  
  <p>After enabling Spring Security the bootstrap css file won't load with the error message:</p>
  
  <pre><code>Refused to execute script from 'http://localhost:8080/js/bootstrap.min.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled. 
  </code></pre>
  
  <p>The error message above comes from the chrome developer console.</p>
  
  <p><strong><em>What I've tried:</em></strong></p>
  
  <ul>
  <li>Disabling the Spring Security
  => bootstrap css works again, but I need the security</li>
  <li>Searching on the spring forums, but theres a looped link without a solution</li>
  <li>Adding a resources handler, but I can't see that the handler is invoked nor the error disappears</li>
  <li>Adding the resources path to the <code>permit</code> call</li>
  </ul>
  
  <p>My dir structure:</p>
  
  <pre><code>/main
    |-&gt; /java
         | BootStart.java
         |-&gt; /security
                |SecurityConfiguration.java
    |-&gt; /resources
           |-&gt; /static
                 |-&gt; /css /** bootstrap location */
                 |-&gt; /js
                 |-&gt; /fonts
           |-&gt; /templates
                 | /user
                     | sample.html
  </code></pre>
  
  <p>BootStart.java is the java file that gets picked up by Spring Boot. </p>
  
  <p>BootStart.java:</p>
  
  <pre><code>@EnableAutoConfiguration
  @ComponentScan
  public class BootStart {
      public static void main(String[] args) {
          SpringApplication.run(BootStart.class, args);
      }
  }
  </code></pre>
  
  <p>SecurityConfiguration.java:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .formLogin()
                  .loginPage("/login")
                  .permitAll()
                  .and()
                  .logout()
                  .permitAll();
          http
                  .authorizeRequests()
                  .antMatchers("/", "/resources/static/**").permitAll()
                  .anyRequest().authenticated();
  
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth
                  .inMemoryAuthentication()
                  .withUser("user").password("password").roles("USER");
      }
  }
  </code></pre>
  
  <p>Sample.html:</p>
  
  <pre><code>&lt;!DOCTYPE HTML&gt;
  &lt;html&gt;
  &lt;head&gt;
      &lt;link rel="stylesheet" th:href="@{/css/bootstrap.css}" href="../../css/bootstrap.min.css"/&gt;
      &lt;link rel="stylesheet" th:href="@{/css/bootstrap-theme.css}" href="../../css/bootstrap-theme.min.css"/&gt;
      &lt;title&gt;&lt;/title&gt;
      &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;div class="alert alert-danger" role="alert"&gt;!Basic template!&lt;/div&gt;
  
  &lt;script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"&gt;&lt;/script&gt;
  &lt;script src="js/bootstrap.min.js"&gt;&lt;/script&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Currently I'm using the following dependencies in my pom:</p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-thymeleaf&lt;/artifactId&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
      &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt;
      &lt;version&gt;3.2.4.RELEASE&lt;/version&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
      &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
      &lt;version&gt;3.2.4.RELEASE&lt;/version&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
      &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
      &lt;version&gt;3.2.4.RELEASE&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>How must I configure Spring Security that I can load css/ js files from my /static resources directory?</p>