title: How do I use "/images" path in Spring boot Rest controller with security?
body: <p>I have a Spring boot REST service (spring-boot-starter-parent:1.3.2) that exposes some endpoints using RestController defined methods. I am also using Spring security. Everything works fine until I try to define a controller method that is mapped to "/images". When I try to access this api path I get the following error. By debugging I can see that my controller handler is being mapped, but the preauthorize filter is not being called (it is called properly for other mappings). I have set the following properties, but with no change. How do I fix this so that I can use "/images"?</p>
  
  <pre><code>spring.resources.add-mappings=false
  spring.mvc.static-path-pattern=/hide-me/**
  </code></pre>
  
  <p>Error:</p>
  
  <pre><code>    "exception": "org.springframework.security.authentication.AuthenticationCredentialsNotFoundException",
      "message": "An Authentication object was not found in the SecurityContext",
  </code></pre>
  
  <p>Code:</p>
  
  <pre><code>@RestController
  @PreAuthorize(value = "hasAnyAuthority('SOMEUSER')")
  public class ImageController {
    ...
    @RequestMapping(value = { "/images/{imageId}" }, method = RequestMethod.GET)
    @ResponseBody
    public Image getImage(@PathVariable UUID imageId) {
      return imageDataService.getImage(imageId);
    }
    ...
  </code></pre>
  
  <p>If I change the mapping to the following then it works just fine.</p>
  
  <pre><code>  @RequestMapping(value = { "/image/{imageId}" }, method = RequestMethod.GET)
    @ResponseBody
    public Image getImage(@PathVariable UUID imageId) {
      return imageDataService.getImage(imageId);
    }
  </code></pre>
  
  <p>I'm thinking that the config for static resources has a default entry that tells Spring security to ignore the "/images" path for the preauth filter. I'm debugging around trying to figure out where that might be overridden.</p>