Multiple spring security configurations for formLogin and basic auth - spring

Question

I have a web application with the standard form login authentication and I'm trying to add an api section secured with basic auth.
My security config file looks like:
#Configuration
#EnableWebSecurity
#EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
class SecurityConfig extends WebSecurityConfigurerAdapter {
#Configuration
#Order(1)
public static class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter{
#Override
protected void configure(HttpSecurity http) throws Exception {
http.antMatcher("/api/**")
.httpBasic().and()
.authorizeRequests().anyRequest().fullyAuthenticated().and()
.csrf().disable().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
#Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("test").password("pass").roles("USER")
.and().withUser("test2").password("pass").roles("ADMIN");
}
}
#Configuration
#Order(2)
public static class FormWebSecurityConfig extends WebSecurityConfigurerAdapter{
#Autowired
private UserDetailsService userDetailsService;
#Autowired
private LoginSuccessHandler loginSuccessHandler;
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
//loginSuccessHandler.setDefaultTargetUrl("/landing");
http.authorizeRequests().anyRequest().fullyAuthenticated()
.and()
// .httpBasic().and()
.formLogin()
.loginPage("/login")
.failureUrl("/login?error")
.successHandler(loginSuccessHandler)
// login success redirect handled by loginSuccessHandler
//.defaultSuccessUrl("/landing")
.usernameParameter("email")
.permitAll()
.and()
.logout()
.logoutUrl("/logout")
.deleteCookies("remember-me")
.addLogoutHandler(logoutHandler)
//.logoutSuccessHandler(logoutSuccessHandler)
.logoutSuccessUrl("/login")
.permitAll()
.and()
.rememberMe();
}
#Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService)
.passwordEncoder(new BCryptPasswordEncoder());
}
#Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers(
"/**/*.css", "/**/*.png", "/**/*.gif", "/**/*.jpg", "/**/*.js","/**/*.map", "/fonts/*");
}
}
}
I'm testing with two urls: api/test and api/testSecured. Without the ApiWebSecurityConfig configuration, visiting api/test produces the expected response and api/testSecured redirects to the login page. WITH ApiWebSecurityConfig, however, both urls result in 404s. Why would this be? I was expecting the same content on api/test and 401 on api/testSecured
edit:
The logs show:
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.b.c.web.OrderedRequestContextFilter : Bound request context to thread: org.apache.catalina.connector.RequestFacade#2f3745b1
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/test'; against '/**/*.css'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/test'; against '/**/*.png'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/test'; against '/**/*.gif'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/test'; against '/**/*.jpg'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/test'; against '/**/*.js'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/test'; against '/**/*.map'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/test'; against '/fonts/*'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/test'; against '/api/**'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher#71a60793
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/test'; against '/logout'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 5 of 11 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
2016-08-22 01:13:13.517 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2016-08-22 01:13:13.518 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2016-08-22 01:13:13.518 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
2016-08-22 01:13:13.518 DEBUG --- [nio-1010-exec-2] .s.s.w.a.AnonymousAuthenticationFilter : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken#6fabe8e0: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffe9938: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 3F32CE65028D5FCD8C8589AFA4D842AD; Granted Authorities: ROLE_ANONYMOUS'
2016-08-22 01:13:13.518 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
2016-08-22 01:13:13.518 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2016-08-22 01:13:13.518 DEBUG --- [nio-1010-exec-2] .s.security.web.FilterChainProxy : /api/test at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2016-08-22 01:13:13.518 DEBUG --- [nio-1010-exec-2] .s.s.w.a.i.FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /api/test; Attributes: [fullyAuthenticated]
2016-08-22 01:13:13.518 DEBUG --- [nio-1010-exec-2] .s.s.w.a.i.FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken#6fabe8e0: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffe9938: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 3F32CE65028D5FCD8C8589AFA4D842AD; Granted Authorities: ROLE_ANONYMOUS
2016-08-22 01:13:13.518 DEBUG --- [nio-1010-exec-2] .s.s.access.vote.AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter#36fb2af7, returned: -1
2016-08-22 01:13:13.520 DEBUG --- [nio-1010-exec-2] .s.s.w.a.ExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:83) ~[spring-security-core-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:232) ~[spring-security-core-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:123) ~[spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:90) ~[spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114) ~[spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:122) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:169) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:48) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:120) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176) [spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:87) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:522) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1095) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:672) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1502) [tomcat-embed-core-8.0.33.jar:8.0.33]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1458) [tomcat-embed-core-8.0.33.jar:8.0.33]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [na:1.8.0_51]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [na:1.8.0_51]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.0.33.jar:8.0.33]
at java.lang.Thread.run(Unknown Source) [na:1.8.0_51]
2016-08-22 01:13:13.520 DEBUG --- [nio-1010-exec-2] .s.s.w.a.ExceptionTranslationFilter : Calling Authentication entry point.
2016-08-22 01:13:13.520 DEBUG --- [nio-1010-exec-2] s.w.a.DelegatingAuthenticationEntryPoint : Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]
2016-08-22 01:13:13.520 DEBUG --- [nio-1010-exec-2] s.w.a.DelegatingAuthenticationEntryPoint : No match found. Using default entry point org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint#37f512ab
2016-08-22 01:13:13.520 DEBUG --- [nio-1010-exec-2] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
2016-08-22 01:13:13.520 DEBUG --- [nio-1010-exec-2] .s.b.c.web.OrderedRequestContextFilter : Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade#2f3745b1
2016-08-22 01:13:13.521 DEBUG --- [nio-1010-exec-2] .s.web.servlet.DispatcherServlet : DispatcherServlet with name 'dispatcherServlet' processing GET request for [/401.html]
2016-08-22 01:13:13.521 DEBUG --- [nio-1010-exec-2] s.w.s.m.m.a.RequestMappingHandlerMapping : Looking up handler method for path /401.html
2016-08-22 01:13:13.523 DEBUG --- [nio-1010-exec-2] s.w.s.m.m.a.RequestMappingHandlerMapping : Did not find handler method for [/401.html]
2016-08-22 01:13:13.523 DEBUG --- [nio-1010-exec-2] .s.d.r.w.BasePathAwareHandlerMapping : Looking up handler method for path /401.html
2016-08-22 01:13:13.524 DEBUG --- [nio-1010-exec-2] .s.d.r.w.BasePathAwareHandlerMapping : Did not find handler method for [/401.html]
2016-08-22 01:13:13.524 DEBUG --- [nio-1010-exec-2] .s.d.r.w.RepositoryRestHandlerMapping : Looking up handler method for path /401.html
2016-08-22 01:13:13.529 DEBUG --- [nio-1010-exec-2] .s.d.r.w.RepositoryRestHandlerMapping : Did not find handler method for [/401.html]
2016-08-22 01:13:13.529 DEBUG --- [nio-1010-exec-2] .s.w.s.handler.SimpleUrlHandlerMapping : Matching patterns for request [/401.html] are [/**]
2016-08-22 01:13:13.529 DEBUG --- [nio-1010-exec-2] .s.w.s.handler.SimpleUrlHandlerMapping : URI Template variables for request [/401.html] are {}
2016-08-22 01:13:13.529 DEBUG --- [nio-1010-exec-2] .s.w.s.handler.SimpleUrlHandlerMapping : Mapping [/401.html] to HandlerExecutionChain with handler [ResourceHttpRequestHandler [locations=[ServletContext resource [/], class path resource [META-INF/resources/], class path resource [resources/], class path resource [static/], class path resource [public/]], resolvers=[org.springframework.web.servlet.resource.PathResourceResolver#5bf7e3d3]]] and 1 interceptor
2016-08-22 01:13:13.529 DEBUG --- [nio-1010-exec-2] .s.web.servlet.DispatcherServlet : Last-Modified value for [/401.html] is: -1
2016-08-22 01:13:13.530 DEBUG --- [nio-1010-exec-2] .s.web.servlet.DispatcherServlet : Null ModelAndView returned to DispatcherServlet with name 'dispatcherServlet': assuming HandlerAdapter completed request handling
2016-08-22 01:13:13.530 DEBUG --- [nio-1010-exec-2] .s.web.servlet.DispatcherServlet : Successfully completed request
Also, commenting out the second configuration doesn't change anything for the api/.. requests, they still 404.