WebSecurityConfig.java

@Override
protected void configure(HttpSecurity http) throws Exception {
  http.authorizeRequests()
        .antMatchers("/signup", "/static/**").permitAll()
        .antMatchers("/code").hasRole("PRE_AUTH_USER")
        .antMatchers("/home").hasRole("USER")
        .anyRequest().authenticated();

  http.formLogin()
        .loginPage("/login")
        .permitAll()
        // always use the default success url despite if a protected page had been previously visited
        .defaultSuccessUrl("/code", true)
        .and()
      .logout()
        .permitAll();