Eu configurei um projeto spring-boot + spring-mvc + spring-security.

Tudo funciona como esperado no momento, exceto pelos URLs inválidos.

Se eu emitir:

http://siteaddr.com/invalid/url

Espero ver minha página 404 não encontrada, mas o Spring-Security redireciona para a página de login primeiro e após a autenticação mostrar 404 não encontrado!

Eu não acho que é assim que deve funcionar!

Aqui está minha configuração do Websecurity:

package com.webitalkie.webapp.config;

import java.util.EnumSet;

import javax.servlet.DispatcherType;
import javax.servlet.ServletContext;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

import com.webitalkie.webapp.security.DatabaseUserDetailsServic;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private DatabaseUserDetailsServic userDetailsService;
    @Autowired
    private ServletContext servletContext;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        servletContext.getFilterRegistration(AbstractSecurityWebApplicationInitializer
                .DEFAULT_FILTER_NAME).addMappingForUrlPatterns(EnumSet
                        .allOf(DispatcherType.class), false, "/*");

        http.csrf().disable();
        http.authorizeRequests()
        .antMatchers("/home/", "/home", "/home/index", "/", "/favicon.ico").permitAll()
        .antMatchers("/contents/**").permitAll()
        .anyRequest().authenticated()
        .and()
        .formLogin()
        .loginPage("/home/loginsec").failureUrl("/loginsecerror").permitAll()
        .and()
        .logout()
        .logoutUrl("/home/logout")
        .logoutSuccessUrl("/home/index")
        .invalidateHttpSession(true);

    }

    @Override
    @org.springframework.beans.factory.annotation.Autowired
    protected void configure(
            org.springframework.security.config.annotation
            .authentication.builders.AuthenticationManagerBuilder auth) throws Exception {

        auth.userDetailsService(userDetailsService).passwordEncoder(getPasswordEncoder());
    }

    public PasswordEncoder getPasswordEncoder() {

        return new BcryptPasswordEncoder(11);
    }
}

Vocês têm alguma ideia?