protected void configureEndpointAccessForStaticResources(final HttpSecurity requests) throws Exception {
        requests.authorizeHttpRequests(customizer -> {
            customizer.requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll();
            customizer.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher("/resources/**")).permitAll();
            customizer.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher("/static/**")).permitAll();
            customizer.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher("/public/**")).permitAll();
            customizer.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher("/favicon**")).permitAll();
            Arrays.stream(webProperties.getResources().getStaticLocations())
                .forEach(location -> {
                    if (location.startsWith(ResourceUtils.FILE_URL_PREFIX)) {
                        val file = new File(StringUtils.remove(location, ResourceUtils.FILE_URL_PREFIX));
                        if (file.exists() && file.isDirectory()) {
                            val directories = Arrays.stream(file.listFiles(File::isDirectory)).toList();
                            LOGGER.info("Directories to authorize for static public resources are [{}]", directories);
                            directories.forEach(directory -> customizer.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher('/' + directory.getName() + "/**")).permitAll());
                        }
                    }
                });
        });
    }
Configure http security.

@param http the http
@return the http security
@throws Exception the exception
support/cas-server-support-webconfig/src/main/java/org/apereo/cas/web/security/CasWebSecurityConfigurerAdapter.java