SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    /* other code left out for brevity */

    /**
     * Configure HttpSecurity, adds a CsrfTokenGeneratorFilter after CsrfFilter.
     *
     * @param http
     * @throws Exception
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .addFilterAfter(new CsrfTokenGeneratorFilter(), CsrfFilter.class)
                .authorizeRequests()
                    .antMatchers("/scripts/**", "/styles/**", "/font/**", "/fonts/**").permitAll()
                    .antMatchers("/**").authenticated()
                    .and()
                .formLogin()
                    .loginPage("/login").permitAll();
    }
}