Prevent spring security from accessing entities via references

Question

My problem is that react makes requests along different paths to get css, js, images, etc., and spring blocks them and returns 401. If you explicitly specify the paths, everything works. Working settings:

http.cors().and().csrf().disable()
                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                .authorizeRequests()
                .antMatchers("/admin").hasRole("ADMIN")
                .antMatchers("/").permitAll()
                .antMatchers("/favicon.ico").permitAll()
                .antMatchers("/static/**").permitAll()
                .antMatchers("/manifest.json").permitAll()
                .antMatchers("/logo192.png").permitAll()
                .antMatchers("/api/auth/**").permitAll()
                .antMatchers("/api/test/**").permitAll()
                .anyRequest().authenticated();

I want to fix the problem with manually entering each loadable object along the path. If I set the value "/ **" in the spring security settings, then users will be able to receive json with all tables from the database, for example, localhost access opens to the users table: localhost:8080/users displays a list of users in json format, as well as with the rest of the tables Spring MVC Config

@Configuration
public class MvcSecurityConfig implements WebMvcConfigurer {
    @Value("${path.frontend}")
    private String frontendPath;
    @Value("${frontendStaticResourcesPathPatterns}")
    private String[] frontendStaticResourcesPathPatterns;
    private static final String BASE_API_PATH = "/";

    public void addResourceHandlers(ResourceHandlerRegistry registry){
        String pathToFrontend = "file:" + this.frontendPath;
        String pathToIndexHTML = pathToFrontend + "/index.html";

        registry
                .addResourceHandler(frontendStaticResourcesPathPatterns)
                .setCachePeriod(0)
                .addResourceLocations(pathToFrontend);

        registry.addResourceHandler("/", "/**")
                .setCachePeriod(0)
                .addResourceLocations(pathToIndexHTML)
                .resourceChain(true)
                .addResolver(new PathResourceResolver() {
                    @Override
                    protected Resource getResource(String resourcePath, Resource location) throws IOException {
                        if (resourcePath.startsWith(BASE_API_PATH) || resourcePath.startsWith(BASE_API_PATH.substring(1))) {
                            return null;
                        }
                        return location.exists() && location.isReadable() ? location : null;
                    }
                });

    }

}

Spring Security Config

@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    UserDetailsServiceImpl userDetailsService;

    @Autowired
    private AuthEntryPointJwt unauthorizedHandler;

    @Bean
    public AuthTokenFilter authenticationJwtTokenFilter() {
        return new AuthTokenFilter();
    }

    @Override
    public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.cors().and().csrf().disable()
                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                .authorizeRequests()
                .antMatchers("/admin").hasRole("ADMIN")
                .antMatchers("/").permitAll()
                .antMatchers("/api/auth/**").permitAll()
                .antMatchers("/api/test/**").permitAll()
                .anyRequest().authenticated();

        http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);

    }
}