404 when WebSecurityConfig is present - spring

Question

spring-boot-starter-parent 2.4.1
spring-boot-starter-security
package ru.pcask.securing.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
#Configuration
#EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.permitAll()
.and()
.logout()
.permitAll();
}
#Bean
#Override
public UserDetailsService userDetailsService() {
UserDetails user =
User.withDefaultPasswordEncoder()
.username("user")
.password("password")
.roles("USER")
.build();
return new InMemoryUserDetailsManager(user);
}
}
This was copied from an official tutorial (https://spring.io/guides/gs/securing-web/).
The problem:
When I comment every line in his config file out, it shows a Spring security login page. The very login form that is out of the box, made using Bootstrap.
But when I uncomment this code and am redirected to http://localhost:8080/login, this error appears:
Whitelabel Error Page
This application has no explicit mapping for /error, so you are seeing this as a fallback.
Wed Dec 30 19:50:40 MSK 2020
There was an unexpected error (type=Not Found, status=404).
What can I try next to solve this?

Answer 1

the problem is here in this line of code, you want every request to be authenticated.
anyRequest().authenticated()
if you would like to white list some links or all, you can add them explicitly, this is extremely important to add before above call
.anyMatchers("/**").permitAll() // whitelists all
.anyMatchers("/pages/**").permitAll() // whitelists /pages/...
.anyRequest().authenticated()