Spring Security - AngularJS - Protect Angular static content -

long story short, trying protect legacy angular application spring security. whole angular static stuff under

src/main/resources/static 

and stuff should subject securing under

src/main/resources/static/protected-stuff 

here configuration (it part of overall spring boot app configuration):

  @override     protected void configure(httpsecurity http) throws exception {         http.formlogin()                 .loginpage("/login.html").permitall()                 .loginprocessingurl("/dologin")                 .failureforwardurl("/login.html?iserror=true")                 .failureurl("/login.html?iserror=true")                 .defaultsuccessurl("/protected-stuff/index.html")                 .and()                 .authorizerequests()                 .antmatchers(httpmethod.get, "/", "/index.html", "/home.html", "/login/**").permitall()                 .antmatchers("/protected-stuff/**").authenticated()                 .and()                 .csrf().disable();     } 

now, part problematic me is:

                    .antmatchers("/protected-stuff/**").authenticated() 

redirecting on errorneus login, processing login request (it hits authenticationprovider) etc works redirection protected stuff after successful authentication results in redirection login page. suspect resource filters , spring sec interceptors (ok, again, filters) clashing each other can't sure possible overcome such situation?

any help/suggestion welcome , appreciated.

i've managed determine actual issue debugging through spring security , through spring boot. ordering of configurations spring boot loads. nothing in spring security itself. giving spring sec's config highest order.