beginnerSpring Security Architecture: The Filter Chain & Internal Flow
Why must the custom login page URL itself be included in permitAll()?
If the login page required authentication like any other protected resource, an unauthenticated user trying to reach it would be redirected BACK to the login page they're not allowed to see — an infinite redirect loop. The login page (and typically the CSS/JS it needs) must always be publicly accessible so an unauthenticated user can actually reach it.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response